Loading malware…
CANONSTAGER is a Windows malware loader used in cyber-espionage operations linked to the Chinese-affiliated threat cluster UNC6384, which has been associated with Mustang Panda, TEMP.Hex, and Silk Typhoon. It is designed to launch a memory-resident PlugX backdoor variant tracked as SOGU.SEC by abusing DLL side-loading with a legitimate Canon printer utility. The loader decrypts and executes the final payload entirely in memory, reducing disk artifacts and complicating detection.
CANONSTAGER has been observed in campaigns targeting diplomats and European governmental or diplomatic entities, including operations aligned with intelligence collection objectives related to regional policy coordination and defense cooperation. Reported delivery chains include spearphishing lures themed around authentic diplomatic events that lead to malicious Windows shortcut files exploiting CVE-2025-9491, as well as adversary-in-the-middle captive-portal hijacking that redirects victims to a fake software update page. In the latter tradecraft, a signed downloader retrieves an installer that deploys CANONSTAGER and the encrypted PlugX payload.
The loader employs multiple stealth and evasion mechanisms. It abuses legitimate executables to side-load a malicious DLL, uses custom API hashing to obscure Windows API resolution, and has been documented creating a hidden zero-sized window to conceal execution. Reporting also notes use of thread local storage and indirect execution through Windows message queues and hidden window procedures. CANONSTAGER functions primarily as an execution stage for SOGU.SEC/PlugX rather than as a full-featured access tool itself, enabling the downstream backdoor to provide remote access, command execution, file transfer, reconnaissance, persistence, and related espionage capabilities on compromised Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The archive contains three files: A legitimate Canon printer assistant utility, a malicious DLL dubbed CanonStager that's sideloaded using the binary, and an encrypted PlugX payload ("cnmplog.dat") that's launched by the DLL.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The archive contains three files: A legitimate Canon printer assistant utility, a malicious DLL dubbed CanonStager that's sideloaded using the binary, and an encrypted PlugX payload ("cnmplog.dat") that's launched by the DLL.
"...installs CANONSTAGER, a launcher that side-loads and executes the encrypted SOGU.SEC backdoor entirely in memory."
13 distinct techniques documented for this family, organized by ATT&CK tactic.
"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
"...SOGU.SEC backdoor in RC-4 encrypted form. CANONSTAGER decrypts and loads the final payload..."
Google Threat Intelligence Group ... “discovered evidence of a captive portal hijack being used to deliver malware disguised as an Adobe Plugin update to targeted entities.”
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stager malware that remains hidden by creating a zero-sized window.
Malicious DLL used for DLL side-loading via a legitimate Canon utility to decrypt/load and launch an encrypted PlugX payload.
Lightweight DLL loader used to decrypt and execute the PlugX payload. Delivered alongside a legitimate signed Canon utility (cnmpaui.exe) and an encrypted payload blob (cnmplog.dat). Implements API hashing/PEB walking, RC4 decryption, and execution via callback (EnumSystemGeoID) in the streamlined 4KB variant; supports in-memory execution to reduce on-disk artifacts and evade detection.
... CANONSTAGER ... (v1.0) ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.