Loading story…
Researchers analyzed a 32-bit Windows shellcode sample used as the second-stage payload in a spear-phishing campaign that delivered a malicious SolidPDFCreator.dll alongside a benign-looking executable to side-load malware on victim systems in India. The payload, identified with high confidence as a Mustang Panda ToneShell variant and tracked as APT S1239, was extracted from the DLL’s decryption path tied to GetSPApp and executed through an EnumSystemLocalesA callback. The sample, referred to as beacon.bin, is position-independent x86 shellcode of roughly 9 KB of code and 4 KB of data and was linked to an activity cluster labeled “Target India 2026-05-28 Campaign 3.”
The shellcode resolves APIs by hash, constructs its command-and-control URL character by character, stores a 16-byte HMAC key on disk, and communicates with the hardcoded domain couldinstallup[.]com over WinHTTP WebSocket on port 443 while relaxing TLS certificate validation. Its observed functions include periodic beaconing, keep-alive heartbeats, file download capability, and a two-slot cmd.exe reverse shell. Although the malware shares the 0xC85E31 cs_djb2 hashing constant and some structural similarities with Cobalt Strike, the analysis concluded it is a custom Mustang Panda beacon rather than standard Cobalt Strike tooling.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
A malware analysis published on July 21, 2026 re-analyzed a 32-bit shellcode sample identified as a Mustang Panda ToneShell variant and attributed it with high confidence to Mustang Panda. The write-up detailed its API hashing, hardcoded C2 construction, HMAC key persistence, WinHTTP WebSocket communications, and reverse-shell and file-download capabilities.
A spear-phishing campaign targeting India used a ZIP attachment containing a benign-looking executable and a malicious SolidPDFCreator.dll that side-loaded and decrypted a second-stage shellcode payload. One reference labels the activity as the "Target India 2026-05-28 Campaign 3" campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcekienmanowar.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a Windows DLL backdoor dubbed **SolidPDFCreator** and attributed it to the China-linked threat group **Mustang Panda**, describing the malware as a **stage-1 backdoor** used in a campaign targeting entities in India. The sample was tied to **"Target India – Campaign 3"** and documented as an early-access implant intended to establish an initial foothold on compromised systems. Available reporting describes the malware as a DLL-based payload and provides core triage details including file type, size, hashes, compiler characteristics, and binary section information. The publication of these indicators gives defenders material to hunt for related activity and assess whether Mustang Panda infrastructure or tooling associated with **SolidPDFCreator** is present in their Windows environments.
Jul 13, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026