Loading story…
Researchers identified a Windows DLL backdoor dubbed SolidPDFCreator and attributed it to the China-linked threat group Mustang Panda, describing the malware as a stage-1 backdoor used in a campaign targeting entities in India. The sample was tied to "Target India – Campaign 3" and documented as an early-access implant intended to establish an initial foothold on compromised systems.
Available reporting describes the malware as a DLL-based payload and provides core triage details including file type, size, hashes, compiler characteristics, and binary section information. The publication of these indicators gives defenders material to hunt for related activity and assess whether Mustang Panda infrastructure or tooling associated with SolidPDFCreator is present in their Windows environments.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
A malware analysis documented a Windows DLL sample identified as a Mustang Panda stage-1 backdoor codenamed "SolidPDFCreator." The reporting linked the sample to "Target India – Campaign 3," indicating targeting associated with India.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcekienmanowar.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed a 32-bit Windows shellcode sample used as the second-stage payload in a spear-phishing campaign that delivered a malicious `SolidPDFCreator.dll` alongside a benign-looking executable to side-load malware on victim systems in India. The payload, identified with high confidence as a **Mustang Panda** `ToneShell` variant and tracked as **APT S1239**, was extracted from the DLL’s decryption path tied to `GetSPApp` and executed through an `EnumSystemLocalesA` callback. The sample, referred to as `beacon.bin`, is position-independent x86 shellcode of roughly 9 KB of code and 4 KB of data and was linked to an activity cluster labeled “Target India 2026-05-28 Campaign 3.” The shellcode resolves APIs by hash, constructs its command-and-control URL character by character, stores a 16-byte HMAC key on disk, and communicates with the hardcoded domain `couldinstallup[.]com` over WinHTTP WebSocket on port `443` while relaxing TLS certificate validation. Its observed functions include periodic beaconing, keep-alive heartbeats, file download capability, and a two-slot `cmd.exe` reverse shell. Although the malware shares the `0xC85E31` `cs_djb2` hashing constant and some structural similarities with **Cobalt Strike**, the analysis concluded it is a custom Mustang Panda beacon rather than standard Cobalt Strike tooling.
Jul 21, 2026
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Aug 22, 2026
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026