Threat Actor
UNK_SteadySplit
- First Reported
- Apr 1, 2026
- Latest Reported
- Apr 4, 2026
Reported Context (2)
- The article explicitly identifies UNK_SteadySplit as an alternate name for Mustang Panda. TA416 Uses Evolving PlugX Delivery Chains to Target European Governments
- Proofpoint tracks UNK_SteadySplit as a distinct malicious cluster using TONESHELL, PUBLOAD, and other malware in phishing campaigns. Proofpoint describes historical technical overlaps with TA416 but says it cannot assess the nature of any organizational, personnel, or hierarchical link. TA416 Resumes Espionage Campaigns Against European Governments, Expands Into Middle East
Malware (4)
People (2)
Threat Actors (10)
MITRE ATT&CK (15)
Vendors (3)
Products (6)
Tools (2)
Industries (3)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.