Loading malware…
SHARDLOADER is a Windows malware loader associated with the China-linked espionage group Mustang Panda. It is designed to execute through DLL sideloading by pairing a malicious DLL with a legitimate, digitally signed application, allowing the malware to blend into normal software execution and evade scrutiny. Reported campaigns used spearphishing lures delivered in compressed archives, with the malicious DLL concealed alongside sideloading components.
SHARDLOADER has been observed establishing persistence on compromised hosts and then decrypting and launching follow-on payloads. Documented variants reconstructed embedded shellcode from internal data sections and executed it through callback-based techniques, while later variants extracted additional sideloading components and configured recurring execution through scheduled tasks. Its primary role is to stage and deploy secondary espionage implants rather than to conduct collection directly.
In observed Mustang Panda operations, SHARDLOADER delivered the implants MINIRECON and ZOHOMURK. MINIRECON is a TONESHELL-related backdoor used for remote command execution, file transfer, reverse shell access, and operator-driven reconnaissance. ZOHOMURK is an implant that abuses Zoho WorkDrive for command-and-control, remote tasking, and data exfiltration, helping malicious traffic blend with legitimate cloud-service usage. These campaigns targeted Indian government entities and the hydropower sector, reflecting intelligence-collection objectives aligned with long-term state-sponsored espionage.
SHARDLOADER demonstrates moderate sophistication through its use of DLL sideloading, persistence mechanisms, staged payload decryption, and support for covert post-compromise tooling. Its operational context, malware overlaps, and tradecraft link it to Mustang Panda activity focused on government, diplomatic, and other strategically significant targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Both campaigns opened the same way: a previously undocumented loader tracked as SHARDLOADER, delivered as a malicious DLL and sideloaded through a legitimate, digitally signed executable.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Acronis published indicators and hunting tips, including the persistence Run keys, a scheduled task named SolidPDFPcl2Bmp...
it uses the COM-based Task Scheduler API to register for a scheduled task named SolidPDFPcl2Bmp... configured to repeat every five minutes... Finally, the task is registered under the root folder
Acronis published indicators and hunting tips, including the persistence Run keys, a scheduled task named SolidPDFPcl2Bmp...
Acronis published indicators and hunting tips, including the persistence Run keys, a scheduled task named SolidPDFPcl2Bmp...
Both were delivered as ZIP archives, distributed via spearphishing, in which the malicious DLL was marked with the hidden attribute.
Alert on trusted applications (Solid PDF Creator, Microsoft DNX, Citrix components) executing from non-standard paths.
Once assembled, each 512-byte chunk is passed through a decryption routine that applies a rolling XOR using a 28-byte key... reconstructs a fully decrypted 34,816-byte shellcode payload in memory.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously undocumented loader used in June 2026 Mustang Panda campaigns against Indian government entities; delivered as a malicious DLL and sideloaded via a legitimate signed executable to launch follow-on implants such as MINIRECON and ZOHOMURK.
Loader used by Mustang Panda in operations leveraging Zoho WorkDrive for command-and-control and data exfiltration.
A newly developed loader used by Mustang Panda that executes via DLL sideloading through legitimate signed binaries and deploys follow-on implants.
Loader used in Mustang Panda campaigns that executes via DLL sideloading through legitimately signed binaries and deploys follow-on implants.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.