Loading story…
Multiple analyses detailed PlugX malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious McUtil.dll, which patched the host process and executed shellcode from Mc.cp; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into svchost.exe and contacted 45.79.125.11:443. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into svchost.exe and msiexec.exe and beaconing to help.yahoo-upgrade.com:443.
Other samples tied to Mustang Panda and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, LMIGuardianDll.dll, and LMIGuardianDat.dat to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named "Written comments of Hungary.docx"; its configuration was XOR-encrypted with the key jOh752oCI. Another fileless chain abused unsecapp.exe to load http_dll.dll, decrypt http_dll.dat in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports 80, 443, 8080, and 8000, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A PlugX-related sample later analyzed as linked to Mustang Panda was submitted to VirusTotal from Latvia. The submission included a lure archive using a malicious LNK, a legitimate LogMeIn executable, a side-loaded DLL, and an encrypted data file.
The analyzed PlugX loader sample contained a date check based on GetSystemTime that compared a computed value against 20140606 before continuing its patching and execution flow.
A CIRCL report dated March 29, 2013 analyzed a PlugX 7.0 RAT variant that used DLL side-loading with a signed McAfee executable, decrypted and decompressed payloads in memory, injected into svchost.exe and msiexec.exe, and communicated with help.yahoo-upgrade.com over port 443.
A separate analysis documented a PlugX sample composed of Mc.exe, McUtil.dll, and Mc.cp, showing how the DLL patched the host process in memory, executed shellcode from Mc.cp, manually mapped the final PlugX DLL, and connected to 45.79.125.11:443 after injecting into svchost.exe.
A detailed analysis described how a legitimate LogMeIn binary side-loaded LMIGuardianDll.dll, which decrypted shellcode from LMIGuardianDat.dat and manually mapped a PlugX DLL exporting BLMSqofHz. The write-up also identified the PlugX configuration XOR key as "jOh752oCI" and noted an embedded decoy document named "Written comments of Hungary.docx."
VinCSS analyzed a fileless PlugX infection chain in which unsecapp.exe loaded http_dll.dll, decrypted http_dll.dat in memory, and executed a final HT.dll payload that established persistence and communicated with C2 over HTTP POST or raw TCP.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
kienmanowar.wordpress.com
Open sourcekienmanowar.wordpress.com
Open sourceblog.vincss.net
Open sourcecircl.lu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026