UNK_SteadySplit
UNK_SteadySplit is a temporary cluster designation used by Proofpoint for a China-aligned espionage actor associated with the broader activity commonly referred to as Mustang Panda. Proofpoint states that Mustang Panda is tracked under two primary clusters: TA416 and UNK_SteadySplit. Known aliases for UNK_SteadySplit include CerenaKeeper and Red Ishtar. Proofpoint reports that UNK_SteadySplit has been active since at least 2022. Historical technical overlaps between UNK_SteadySplit and TA416 have been reported, including Trend Micro’s observation that a UNK_SteadySplit TONESHELL command-and-control IP address was embedded in a filepath within two LNK files used in TA416 campaigns. Proofpoint assessed that these overlaps suggest some organizational, personnel, or hierarchical link between TA416 and UNK_SteadySplit, but stated that the exact relationship remains unclear and that similar overlaps were not observed in recent campaigns. The provided content does not attribute specific targeting, tactics, or procedures directly to UNK_SteadySplit beyond its association with the broader Mustang Panda ecosystem.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A second Proofpoint-tracked cluster associated with Mustang Panda activity; prior research identified technical overlaps with TA416, suggesting some organizational, personnel, or hierarchical link, though the exact relationship remains unclear.
A distinct cluster associated in public reporting with the broader Mustang Panda umbrella, primarily targeting government, hospitality, technology, insurance, and energy organizations in South and Southeast Asia, especially Myanmar and Thailand, using phishing-delivered malware including TONESHELL and PUBLOAD.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.