A Chinese-linked cyberespionage group known as Mustang Panda targeted U.S. government and policy officials with Venezuela-themed phishing emails shortly after Washington’s operation to seize Venezuelan President Nicolás Maduro, according to cybersecurity researchers.

Experts from Acronis’ Threat Research Unit discovered the campaign when they found a malicious zip file titled “US now deciding what’s next for Venezuela” uploaded to a public malware analysis service on 5 January. The file, containing espionage malware, showed technical links to earlier Mustang Panda operations, confirming its origin.

Fast Response to a Geopolitical Event

Researchers said the malware was compiled at 0655 GMT on 3 January, just hours after the U.S. operation began. A sample appeared online two days later, coinciding with Maduro and his wife Cilia Flores pleading not guilty to narcotics and weapons charges in a Manhattan court.

Subhajeet Singha, a reverse engineer and malware analyst with Acronis, explained that the hackers appeared to be working rapidly to exploit an unfolding international event. “These guys were in haste,” he said, adding that the quality of the work was lower than in previous Mustang Panda campaigns.

The malware, once installed, would enable operators to steal sensitive data and maintain persistent access to compromised systems. Researchers suspect the attackers aimed at U.S. government entities and policy-related organisations, though it remains unclear if any were successfully infiltrated.

Attribution and Official Responses

Mustang Panda, previously described by the U.S. Department of Justice as a hacking group sponsored by the People’s Republic of China, has a record of exploiting current affairs to lure targets into revealing information. The group has carried out multiple espionage campaigns across government, defence and policy networks worldwide.

A spokesperson for the Chinese embassy in Washington rejected the allegations, stating: “China has consistently opposed and legally combated all forms of hacking activities, and will never encourage, support or condone cyberattacks. China firmly opposes the dissemination of false information about so-called ‘Chinese cyber threats’ for political purposes.”

The FBI declined to comment on the incident.

with inputs from Reuters