{
  "id": "mofang",
  "name": "Mofang",
  "aliases": [],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Likely China-based",
      "src": [
        "mitre-g0103"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2012,
      "src": [
        "mitre-g0103"
      ],
      "conf": "medium",
      "note": "At least 2012"
    },
    {
      "k": "attack_id",
      "v": "G0103",
      "src": [
        "mitre-g0103"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 6,
      "src": [
        "mitre-g0103"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ShimRat, ShimRatReporter",
      "src": [
        "mitre-g0103"
      ],
      "conf": "high",
      "note": "2 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0103)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/mofang.html",
  "sources": {
    "mitre-g0103": {
      "title": "Mofang, Group G0103",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0103/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}