Skip to content
BlurtekBlurtek
Let’s talk
← Back to blog
Cybersecurity

Mustang Panda Cloud C2: Why Your Antivirus Cannot Detect It

Mustang Panda uses OneDrive as a C2 channel. Your antivirus misses this traffic because it is technically legitimate. We explain the real mechanism.

Blurtek
1 min read72 words
01

Mustang Panda: The APT Group That Turned OneDrive Into a Command Server

Mustang Panda, the China-linked APT group, routes its command and control (C2) infrastructure through services like OneDrive, Google Drive, or Dropbox. The generated traffic is technically indistinguishable from normal corporate file synchronization: it uses the same TLS certificates, the same domains, and passes through firewalls without alerts because it is whitelisted by any organization using Microsoft 365 or Google Workspace.

← Back to blogGet a diagnosis
WE START BY LISTENING

Your next step,
thought through together.

Tell us what needs to improve. We help you decide where to start and what is worth building.

Tell us about your project
admin@blurtek.com+34 604 84 48 03Lleida · Spain