MUSTANG_PANDA__2023__ESET_MQsTTang-MustangPandas-backdoor-Qt-MQTT_03-02-2023.pdf

ESET researchers report on MQsTTang, a custom, single-stage backdoor attributed to the Mustang Panda APT that uses the Qt/QMQTT stack and a public MQTT broker for C2; the report details spearphishing distribution via RAR archives with diplomatic-themed filenames, execution and persistence behavior, anti-analysis checks, IoCs (hashes, IPs, GitHub repos), and ATT&CK technique mappings.