Mustang Panda ToneShell Shellcode Used in SolidPDFCreator DLL Side-Loading Campaign
Threat Actor Intelligence · 2 sources · Updated 3mo ago · First seen Jul 21, 2026
Researchers analyzed a 32-bit Windows shellcode sample used as the second-stage payload in a spear-phishing campaign that delivered a malicious SolidPDFCreator.dll alongside a benign-looking executable to side-load malware on victim systems in India. The payload, identified with high confidence as a Mustang Panda ToneShell variant and tracked as APT S1239, was extracted from the DLL’s decryption path tied to GetSPApp and executed through an EnumSystemLocalesA callback. The sample, referred to as beacon.bin, is position-independent x86 shellcode of roughly 9 KB of code and 4 KB of data and was linked to an activity cluster labeled “Target India 2026-05-28 Campaign 3.”
The shellcode resolves APIs by hash, constructs its command-and-control URL character by character, stores a 16-byte HMAC key on disk, and communicates with the hardcoded domain couldinstallup[.]com over WinHTTP WebSocket on port 443 while relaxing TLS certificate validation. Its observed functions include periodic beaconing, keep-alive heartbeats, file download capability, and a two-slot cmd.exe reverse shell. Although the malware shares the 0xC85E31 cs_djb2 hashing constant and some structural similarities with Cobalt Strike, the analysis concluded it is a custom Mustang Panda beacon rather than standard Cobalt Strike tooling.
