CANONSTAGER
CANONSTAGER is a Windows malware loader/launcher used to deploy the PlugX backdoor, including the memory-resident variant tracked by Google as SOGU.SEC. It is delivered in campaigns attributed to the Chinese-affiliated threat actor UNC6384, which reporting links to TEMP.Hex / Mustang Panda / Silk Typhoon. Observed infection chains include spearphishing campaigns against European diplomatic and government entities in September-October 2025 that used malicious LNK files exploiting ZDI-CAN-25373 / CVE-2025-9491, as well as a separate adversary-in-the-middle captive-portal hijacking campaign targeting diplomats in Southeast Asia and other entities globally via a fake Adobe plugin update. In the LNK-based chain, obfuscated PowerShell extracts an archive containing a legitimate Canon printer assistant utility (cnmpaui.exe), a malicious sideloaded DLL (cnmpaui.dll, referred to as CANONSTAGER), and an encrypted payload file (cnmplog.dat). In the captive-portal chain, a signed downloader retrieves an MSI package that installs CANONSTAGER. CANONSTAGER abuses DLL side-loading through legitimate Canon software, decrypts the encrypted PlugX/SOGU.SEC payload, and loads/executes it entirely in memory, reducing disk artifacts. Reported behaviors include custom API hashing to obfuscate Windows API usage, use of Thread Local Storage to store function addresses, indirect execution via Windows message queues and hidden window procedures, and creation of a hidden zero-sized window. Arctic Wolf reported the loader evolved rapidly, shrinking from roughly 700 KB to roughly 4 KB between September and October 2025. Associated persistence observed in the PlugX deployment includes a Run key value named "CanonPrinter" under Software\Microsoft\Windows\CurrentVersion\Run pointing to cnmpaui.exe in a hidden user-profile directory. Related files and indicators directly mentioned include cnmpaui.exe, cnmpaui.dll, cnmplog.dat, SHA-256 e53bc08e60af1a1672a18b242f714486ead62164dda66f32c64ddc11ffe3f0df for a 4 KB malicious DLL sample, SHA-256 c9128d72de407eede1dd741772b5edfd437e006a161eecfffdf27b2483b33fc7 for cnmplog.dat, RC4 key eQkiwoiuDsvIPsmd, and C2 domains including racineupci[.]org, dorareco[.]net, naturadeco[.]net, cseconline[.]org, vnptgroup[.]it[.]com, and paquimetro[.]net.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The archive contains three files: A legitimate Canon printer assistant utility, a malicious DLL dubbed CanonStager that's sideloaded using the binary, and an encrypted PlugX payload ("cnmplog.dat") that's launched by the DLL.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The archive contains three files: A legitimate Canon printer assistant utility, a malicious DLL dubbed CanonStager that's sideloaded using the binary, and an encrypted PlugX payload ("cnmplog.dat") that's launched by the DLL.
"...installs CANONSTAGER, a launcher that side-loads and executes the encrypted SOGU.SEC backdoor entirely in memory."
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueGoogle found attackers compromised edge devices on the target networks and used those machines to poison captive portals so they redirect to a fake page that advises users to download necessary security updates.
Initial Access
1 technique...used those machines to poison captive portals so they redirect to a fake page that advises users to download necessary security updates. The updates are, in fact, malware...
Execution
2 techniques"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
8 techniquesDuring the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
"...SOGU.SEC backdoor in RC-4 encrypted form. CANONSTAGER decrypts and loads the final payload..."
Google Threat Intelligence Group ... “discovered evidence of a captive portal hijack being used to deliver malware disguised as an Adobe Plugin update to targeted entities.”
Multiple actors and malware are described as concealing execution by spawning PowerShell/console windows with parameters like "-WindowStyle Hidden" / "-W Hidden" / "ProcessWindowStyle.Hidden" or via APIs such as ShowWindow, CreateNoWindow, and CREATE_NO_WINDOW.
Defense Impairment
1 technique"Victims download a digitally signed ‘AdobePlugins.exe’..." and "...unclear whether the entity that signs the files... Chengdu Nuoxin Times Technology Co., Ltd, is knowingly participating... or was compromised."
Command and Control
2 techniquesThe updates are, in fact, malware that first retrieves an MSI package, then installs other malware called CANONSTAGER...
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious DLL used for DLL side-loading via a legitimate Canon utility to decrypt/load and launch an encrypted PlugX payload.
Lightweight DLL loader used to decrypt and execute the PlugX payload. Delivered alongside a legitimate signed Canon utility (cnmpaui.exe) and an encrypted payload blob (cnmplog.dat). Implements API hashing/PEB walking, RC4 decryption, and execution via callback (EnumSystemGeoID) in the streamlined 4KB variant; supports in-memory execution to reduce on-disk artifacts and evade detection.
... CANONSTAGER ... (v1.0) ...
CANONSTAGER (v1.0)
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.