Loading story…
China-linked Mustang Panda continued deploying PlugX in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in Indonesia, Vietnam, Taiwan, and Japan. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats.
Across the cases, the group repeatedly used DLL sideloading, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through Run registry keys and encrypted configuration data. Recent samples used lure archives, malicious LNK files, MSI packages, and decoy PDFs, then chained tools such as PowerShell, mshta, rundll32, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as coastallasercompany.com, ivibers[.]com, meetvibersapi[.]com, and earlier temporally activated domains associated with prior PlugX campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
A lure archive named "Energy_Infrastructure_Situation_Note_Tehran_Province_2026.zip" tied to a Mustang Panda PlugX infection chain was first seen on 2026-03-17 05:42:13 UTC. The ZIP launched a hidden PowerShell loader that extracted and executed staged malware components.
Cyble reported a May 2024 campaign targeting Vietnamese entities with a malicious LNK disguised as a PDF. The chain used forfiles.exe, mshta, PowerShell, DLL sideloading via HP.exe and HPCustPartUI.dll, persistence, and beaconing to back.vlvlvlvl.site.
Cyble observed an April 2024 Mustang Panda campaign targeting Vietnamese entities using a ZIP archive named "huongdan memay.zip" containing a malicious LNK. The infection chain downloaded a lure document, collected host information, and exfiltrated it to megacybernews[.]com.
Lab52 analyzed a campaign targeting Taiwanese government entities and diplomats with a new PlugX variant linked through tradecraft similarities to SmugX and Mustang Panda. The lure document referenced Taiwan's January 2024 presidential election and the Terry Gou/Lai Peixia ticket.
VinCSS selected a log.dll sample for analysis after it was submitted to VirusTotal from Vietnam on 2022-04-25. The DLL read log.dat, decrypted shellcode, and ultimately loaded a PlugX variant in memory.
VinCSS analyzed a log.dat sample later tied to a Mustang Panda-linked PlugX infection chain that was submitted to VirusTotal on 2022-04-20. The file was the encrypted companion payload used by the loader DLL.
In a related late-April 2022 case, the same Japanese campaign infrastructure delivered an ISO file containing a decoy, a legitimate Microsoft Word executable, and a malicious sideloaded DLL. The Golang DLL downloader then retrieved and executed a Cobalt Strike stager.
Multiple Japanese organizations observed a targeted attack campaign in mid-April 2022 involving spear-phishing URLs, ZIP archives, malicious LNK files, decoy PDFs, and Word startup-template abuse. The campaign likely was also active in March 2022.
NTT Security reported that a highly similar LNK sample was uploaded from Japan to VirusTotal in March 2022. Although it used cmd.exe instead of ScriptRunner.exe, it shared overlapping commands and infrastructure with the later April campaign.
A sample sharing the unusual User-Agent characteristic later seen in the Japanese campaign was uploaded from Japan to VirusTotal in January 2022. NTT Security treated it as an early indicator linked to the same activity cluster.
NTT Security reported that the domain differentfor[.]com, later tied to overlapping infrastructure and malware characteristics in the Japanese campaign, was registered in November 2021. The domain shared file paths, HTTP headers, and Cobalt Strike configuration with later activity.
NTT Security found indications that a similar attack using related infrastructure may have occurred in late October 2021 against Japanese targets. A fake Sasakawa Peace Foundation website may have been used to distribute malicious files.
Insikt Group again notified Indonesian authorities in July 2021 after identifying the intrusion activity. According to the report, officials did not provide feedback.
Insikt Group notified Indonesian authorities about the Mustang Panda intrusions in June 2021. The notifications concerned compromises affecting multiple government ministries and agencies.
Insikt Group first discovered the Mustang Panda-linked intrusion affecting Indonesian government networks in April 2021. The finding was based on PlugX command-and-control servers communicating with hosts inside those networks.
Researchers traced PlugX command-and-control communications between Mustang Panda infrastructure and Indonesian government hosts back to at least March 2021. The affected entities included at least ten ministries and agencies, including BIN.
Lab52 detected a June 2020 malware sample that used a legitimate Adobe Suite binary to sideload a malicious DLL and deploy the PlugX trojan. The report assessed with high probability that the sample belonged to a new Mustang Panda campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
anomali.com
Open source0x3obad.github.io
Open sourcecyble.com
Open sourcelab52.io
Open sourceblog.vincss.net
Open sourceinsight-jp.nttsecurity.com
Open sourcetherecord.media
Open sourcelab52.io
Open sourceblog.quarkslab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the China-linked espionage group **Mustang Panda** (`TA416`, `RedDelta`, `PKPLUG`) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files. The intrusions delivered a previously undocumented **Korplug/PlugX** variant dubbed **Hodur**, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as **SmadAV**, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with **RC4**, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Aug 15, 2026
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026
The U.S. Department of Justice and FBI said a court-authorized international operation deleted a **PlugX** malware variant from about **4,258 U.S.-based computers and networks** infected by the China-backed group **Mustang Panda** (also known as **Twill Typhoon**). Authorities said the malware had been used since at least 2014 against U.S. victims as well as governments, businesses, and dissident groups in Europe and Asia. The disruption was carried out with French law enforcement and Sekoia.io, and the FBI used validated malware-deletion commands under nine warrants obtained in the Eastern District of Pennsylvania before notifying affected owners through internet service providers. PlugX has long been tied to Chinese cyber-espionage tradecraft, including **DLL sideloading**, in-memory loading, and remote access capabilities that support persistent access to victim systems. Prior reporting linked Mustang Panda to spear-phishing campaigns against the Hong Kong Catholic Church using archive files and decoy documents to install PlugX, while independent malware analysis showed older PlugX variants remained active with sideloaded components, compressed payloads, and command-and-control infrastructure. The takedown highlights a sustained espionage ecosystem built around PlugX and the continued operational use of the malware across politically sensitive targets.
Aug 15, 2026