PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384)
PlugX Meeting Invitation Campaign (TL-2026-0153), also tracked as PlugX Meeting Invitation Campaign, is a high-severity advanced persistent threat campaign, first published 2026-02-27. It is attributed to Mustang Panda (China) with high confidence, affects Microsoft Windows, maps to 21 MITRE ATT&CK techniques (T1027.002, T1036.005, T1056.001), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0153
- Threat ID
- TL-2026-0153
- Also known as
- PlugX Meeting Invitation Campaign, STATICPLUGIN PlugX, GDATA DLL Sideloading
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-02-27
- Last reviewed
- 2026-02-27
- Attribution
- Mustang Panda
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, defense, foreign_affairs
- Target regions
- Europe, Iceland, Hungary, Belgium, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in PlugX Meeting Invitation Campaign
Malware and tooling: PlugX, Avk.exe, MSBuild.exe
China-aligned threat actor (Mustang Panda / UNC6384 cluster) delivers PlugX RAT via spear-phishing 'Meeting Invitation' email impersonating the Iceland Ministry of Foreign Affairs. Infection chain: MSBuild.exe LOLBIN executes .csproj downloading legitimate G DATA antivirus executable (Avk.exe) which sideloads malicious Avk.dll (Korplug/PlugX variant). Encrypted payload in AVKTray.dat decrypted via XOR 0x4F. RC4-encrypted configuration with key 'fzsbnWTgLLq'. C2 at decoraat[.]net:443 over HTTPS. DJB2 and ROL-19 API hashing for evasion. Part of broader UNC6384 European diplomatic targeting campaign including ZDI-CAN-25373 exploitation.
How PlugX Meeting Invitation Campaign works
A China-aligned threat actor operating within the Mustang Panda / UNC6384 cluster has deployed a PlugX RAT variant through a spear-phishing campaign using 'Meeting Invitation' lures impersonating the Iceland Ministry of Foreign Affairs. This campaign was analyzed by Lab52 (S2 Grupo) and complements IIJ-SECT's analysis of the STATICPLUGIN downloader used by UNC6384.
The infection chain begins with a phishing email containing two links: one redirecting to the legitimate Iceland Ministry of Foreign Affairs website (stjornarradid.is) for credibility, and another downloading a ZIP archive containing two files. The ZIP (SHA256: 29cd44aa) contains Invitation_Letter_No.02_2026.csproj (a MSBuild project script) and Invitation_Letter_No.02_2026.exe (a renamed copy of MSBuild.exe used as a LOLBIN). When the victim executes the .exe, MSBuild processes the .csproj file which contains three Base64-encoded download URLs pointing to onedow.gesecole[.]net/download.
Three files are downloaded: (1) AVK.exe — a legitimate G DATA Antivirus executable (SHA256: 8421e799, 943KB), digitally signed, (2) Avk.dll — the PlugX/Korplug loader (SHA256: 46314092, 5KB), and (3) AVKTray.dat — an XOR-encrypted payload (SHA256: e7ed0cd4, 73KB). All files are renamed with random filenames upon download. A decoy PDF document is displayed to the victim during execution.
The DLL sideloading chain works because AVK.exe requires Avk.dll at runtime. The malicious Avk.dll obtains the payload filename (AVKTray.dat) from an XOR-encoded string in the .rdata section using key 0x7F. It then decrypts AVKTray.dat using XOR with key 0x4F. The decrypted payload contains the PlugX RAT with an embedded decoy PDF in the overlay section.
Avk.dll uses DJB2-based API hashing to resolve module and function addresses — identified hashes include 0x7040EE75 (Kernel32.dll), 0x22D3B5ED (ntdll.dll), with specific API hashes for NtCreateFile, NtQueryInformationFile, NtClose, ReadFile, NtTerminateProcess, NtProtectVirtualMemory, and RtlRegisterWait. The injected PlugX payload uses a different API hashing algorithm based on ROL-19 (rotate-left 19 bits) plus cumulative character summation, resolving APIs from kernel32.dll, ntdll.dll, kernelbase.dll, winhttp.dll, and ws2_32.dll.
The PlugX configuration is RC4-encrypted in the .data section. The RC4 key is 11 bytes: 'fzsbnWTgLLq' (from the 12-byte string 'fzsbnWTgLLqp' truncated to the length field value 0x0B). The decrypted configuration is further encoded using a custom XOR-based algorithm where block_length and config_head_value parameters control decoding. The C2 domain decoraat[.]net communicates over HTTPS port 443 (BB01 indicator).
Persistence is achieved via the Run registry key 'G DATA' at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, executing Avk.exe with numeric arguments from C:\Users\Public\GDatas\.
IIJ-SECT independently analyzed a related STATICPLUGIN variant (Browser_Updater.exe) that downloads an MSI file from 45.251.243[.]210 (former PlugX C2) deploying the same Avk.exe/Avk.dll/AVKTray.dat triad. Their sample's RC4 key was 'VOphJo' (6 bytes from 'VOphJokPpbbQ'), C2 domain fruitbrat[.]com:443 (real IP likely 108.165.255[.]97). The STATICPLUGIN was code-signed with a certificate from Chinese company Shanxi Rongsheng Yuan Kemao Co., Ltd. — the same certificate was used to sign ValleyRAT malware in September 2025.
Arctic Wolf documented UNC6384's broader European diplomatic targeting campaign exploiting ZDI-CAN-25373 (Windows shortcut vulnerability) against Hungarian, Belgian, Serbian, Italian, and Dutch diplomatic entities. Their campaign used Canon printer utilities for DLL sideloading (cnmpaui.exe/cnmpaui.dll/cnmplog.dat) with additional C2 domains: racineupci[.]org, dorareco[.]net, naturadeco[.]net, cseconline[.]org, vnptgroup[.]it.com.
MITRE ATT&CK techniques used in TL-2026-0153
defense-evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1127.001 MSBuild; T1497.001 System Checks; T1620 Reflective Code Loading
collection
T1056.001 Keylogging; T1113 Screen Capture
command-and-control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography
discovery
T1082 System Information Discovery
execution
persistence
T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL
initial-access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
resource-development
T1583.001 Domains; T1588.003 Code Signing Certificates; T1608.001 Upload Malware
Affected products and versions in PlugX Meeting Invitation Campaign
- Microsoft — Windows
Vulnerable versions: All versions with MSBuild.exe - G DATA CyberDefense AG — Avk.exe (G DATA Antivirus)
Vulnerable versions: Legitimate binary abused for DLL sideloading
Remediation for PlugX Meeting Invitation Campaign
Immediate actions
- Block C2 domains: decoraat[.]net, onedow.gesecole[.]net, fruitbrat[.]com at DNS/proxy
- Block IP 108.165.255[.]97 and 45.251.243[.]210 at firewall
- Hunt for Avk.exe in C:\Users\Public\GDatas\ and %LOCALAPPDATA%\pZhozR\
- Check registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for 'G DATA' or 'G Data' entries
- Search for AVKTray.dat and Avk.dll by SHA256 hashes across endpoints
- Block MSBuild.exe execution from user-writable directories
Workarounds
- Disable MSBuild.exe for non-developer users via AppLocker or WDAC
- Block .csproj files at email gateway
- Monitor Run registry keys for entries pointing to C:\Users\Public\ paths
Longer-term hardening
- Implement application control to prevent MSBuild.exe LOLBIN abuse
- Monitor for DLL sideloading of Avk.dll alongside legitimate G DATA executables
- Deploy detection rules for DJB2 and ROL-19 API hashing patterns in memory
- Block .csproj file execution from email attachment contexts
- Monitor WinHTTP connections with the specific PlugX user-agent string
Weaknesses (CWE) in PlugX Meeting Invitation Campaign
CWE-426, CWE-506, CWE-829
Timeline of PlugX Meeting Invitation Campaign
- PlugX RAT first publicly identified — has been consistently linked to China-aligned threat actors including Mustang Panda, APT41, APT10, Deep Panda
- ZDI-CAN-25373 Windows shortcut vulnerability disclosed — UNC6384 adopts it within 6 months for LNK-based PlugX delivery (Arctic Wolf report)
- Arctic Wolf identifies UNC6384 campaign targeting Hungarian and Belgian diplomatic entities using ZDI-CAN-25373 with Canon printer DLL sideloading. C2: racineupci[.]org, dorareco[.]net
- Shanxi Rongsheng Yuan Kemao Co., Ltd. certificate used to sign ValleyRAT malware — same certificate later used for STATICPLUGIN code signing
- Google GTIG documents UNC6384/STATICPLUGIN captive portal hijacking campaign targeting Southeast Asian diplomats
- IIJ-SECT observes new PlugX variant with updated RC4 config encoding — STATICPLUGIN delivers Avk.exe/Avk.dll/AVKTray.dat triad via MSI from 45.251.243[.]210. C2: fruitbrat[.]com (108.165.255[.]97)
- Lab52 identifies PlugX Meeting Invitation campaign: MSBuild LOLBIN + GDATA DLL sideloading. Iceland MFA lure. C2: decoraat[.]net:443. RC4 key: fzsbnWTgLLq
- Lab52, IIJ-SECT, and Arctic Wolf publish concurrent analyses of PlugX/UNC6384 cluster activity. Sources: lab52.io, sect.iij.ad.jp, arcticwolf.com
- Threadlinqs Intelligence publishes TL-2026-0153 with full MITRE mapping, detections, and simulations
- As of 2026-05-29, this Mustang Panda/UNC6384 PlugX campaign remains ACTIVE: Proofpoint (Apr 2026) reports TA416 still running PlugX with .csproj/MSBuild chains and expanding to Mideast diplomats amid the US-Israel-Iran conflict, and cyberandramen (Mar 2026) found the staging infra live. No CVE to patch and no takedown of this cluster (the 2025 FBI op hit an older USB-worm variant); actor undisrupted.
Sources cited for PlugX Meeting Invitation Campaign
- Lab52: PlugX Meeting Invitation via MSBuild and GDATA
- IIJ-SECT: PlugX executed via STATICPLUGIN (latest variant analysis)
- Arctic Wolf: UNC6384 Weaponizes ZDI-CAN-25373 to Deploy PlugX
- Google GTIG: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats
- Hunt.io: Unmasking PlugX Activity via Certificates and Redirects
- ESET: Mustang Panda Hodur — Old Tricks New Korplug Variant
- Malpedia: PlugX
Threats related to PlugX Meeting Invitation Campaign
Detection coverage for TL-2026-0153
As of 2026-02-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0153 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.