Loading story…
Researchers reported that the China-linked espionage group Mustang Panda (TA416, RedDelta, PKPLUG) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files.
The intrusions delivered a previously undocumented Korplug/PlugX variant dubbed Hodur, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as SmadAV, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with RC4, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
As of March 2022, ESET reported the campaign was still ongoing, identified a previously undocumented Korplug/PlugX variant it named Hodur, and attributed the operation with high confidence to Mustang Panda. ESET described the malware’s side-loading chain, anti-analysis features, persistence methods, and custom encrypted TCP command-and-control protocol.
ESET said the Mustang Panda cyberespionage campaign began at least in August 2021. The operation targeted research entities, internet service providers, and diplomatic missions across countries including Mongolia, Vietnam, Myanmar, Greece, Russia, Cyprus, South Sudan, South Africa, and others.
During the April 2021 wave, the malware created a scheduled task named MicrosoftCorp.xml and a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ACMguid. Its second stage connected to 65.21.111.255/maps/overlayBFPR and retrieved a Cobalt Strike beacon.
In the last week of April 2021, attackers sent a new malicious email to a mailing list with a Google Drive link to a RAR archive named "CEC List & CRPH (Meeting minutes).rar." The archive contained a legitimate executable and a malicious Acrobat.dll used for DLL side-loading.
On March 11, 2021, a malicious email was sent to a member of Myanmar’s Committee Representing Pyidaungsu Hluttaw. The message linked to a Google Drive-hosted RAR archive containing a malicious .lnk-based infection chain that abused SmadavProtect32.exe and SmadHook32c.dll for DLL side-loading.
In 2021, Unit 42 documented the previously unseen THOR PlugX variant. Later ESET reporting said Mustang Panda’s Hodur variant closely resembled THOR.
Qurium reported that command-and-control infrastructure later seen in the Myanmar phishing attacks had also been used in another targeted attack in December 2020 attributed to Mustang Panda.
During the ongoing campaign, Mustang Panda refreshed phishing lures to match current European events, including COVID-19 travel restrictions, EU regulations, and Russia’s invasion of Ukraine. Example lure names included "Situation at the EU borders with Ukraine.exe."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.xorhex.com
Open sourcequrium.org
Open sourceavira.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026