PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384) — Threadlinqs Intelligence
As of 2026-05-30, PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384) is a high-severity apt threat attributed to Mustang Panda (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0153 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: Mustang Panda · China · ESPIONAGE
China-aligned threat actor (Mustang Panda / UNC6384 cluster) delivers PlugX RAT via spear-phishing 'Meeting Invitation' email impersonating the Iceland Ministry of Foreign Affairs. Infection chain:
A China-aligned threat actor operating within the Mustang Panda / UNC6384 cluster has deployed a PlugX RAT variant through a spear-phishing campaign using 'Meeting Invitation' lures impersonating the Iceland Ministry of Foreign Affairs. This campaign was analyzed by Lab52 (S2 Grupo) and complements IIJ-SECT's analysis of the STATICPLUGIN downloader used by UNC6384.
The infection chain begins with a phishing email containing two links: one redirecting to the legitimate Iceland Ministry of Foreign Affairs website (stjornarradid.is) for credibility, and another downloading a ZIP archive containing two files. The ZIP (SHA256: 29cd44aa) contains Invitation_Letter_No.02_2026.csproj (a MSBuild project script) and Invitation_Letter_No.02_2026.exe (a renamed copy of MSBuild.exe used as a LOLBIN). When the victim executes the .exe, MSBuild processes the .csproj file which contains three Base64-encoded download URLs pointing to onedow.gesecole[.]net/download.
Three files are downloaded: (1) AVK.exe — a legitimate G DATA Antivirus executable (SHA256: 8421e799, 943KB), digitally signed, (2) Avk.dll — the PlugX/Korplug loader (SHA256: 46314092, 5KB), and (3) AVKTray.dat — an XOR-encrypted payload (SHA256: e7ed0cd4, 73KB). All files are renamed with random filenames upon download. A decoy PDF document is displayed to the victim during execution.
The DLL sideloading chain works because AVK.exe requires Avk.dll at runtime. The malicious Avk.dll obtains the payload filename (AVKTray.dat) from an XOR-encoded string in the .rdata section using key 0x7F. It then decrypts AVKTray.dat using XOR with key 0x4F. The decrypted payload contains the PlugX RAT with an embedded decoy PDF in the overlay section.
Avk.dll uses DJB2-based API hashing to resolve module and function addresses — identified hashes include 0x7040EE75 (Kernel32.dll), 0x22D3B5ED (ntdll.dll), with specific API hashes for NtCreateFile, NtQueryInformationFile, NtClose, ReadFile, NtTerminateProcess, NtProtectVirtualMemory, and RtlRegisterWait. The injected PlugX payload uses a different API hashing algorithm based on ROL-19 (rotate-left 19 bits) plus cumulative character summation, resolving APIs from kernel32.dll, ntdll.dll, kernelbase.dll, winhttp.dll, and ws2_32.dll.
The PlugX configuration is RC4-encrypted in the .data section. The RC4 key is 11 bytes: 'fzsbnWTgLLq' (from the 12-byte string 'fzsbnWTgLLqp' truncated to the length field value 0x0B). The decrypted configuration is further encoded using a custom XOR-based algorithm where block_length and config_head_value parameters control decoding. The C2 domain decoraat[.]net communicates over HTTPS port 443 (BB01 indicator).
Persistence is achieved via the Run registry key 'G DATA' at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, executing Avk.exe with numeric arguments from C:\Users\Public\GDatas\.
IIJ-SECT independently analyzed a related STATICPLUGIN variant (Browser_Updater.exe) that downloads an MSI file from 45.251.243[.]210 (former PlugX C2) deploying the same Avk.exe/Avk.dll/AVKTray.dat triad. Their sample's RC4 key was 'VOphJo' (6 bytes from 'VOphJokPpbbQ'), C2 domain fruitbrat[.]com:443 (real IP likely 108.165.255[.]97). The STATICPLUGIN was code-signed with a certificate from Chinese company Shanxi Rongsheng Yuan Kemao Co., Ltd. — the same certificate was used to sign ValleyRAT malware in September 2025.
Arctic Wolf documented UNC6384's broader European diplomatic targeting campaign exploiting ZDI-CAN-25373 (Windows shortcut vulnerability) against Hungarian, Belgian, Serbian, Italian, and Dutch diplomatic entities. Their campaign used Canon printer utilities for DLL sideloading (cnmpaui.exe/cnmpaui.dll/cnmplog.dat) with additional C2 domains: racineupci[.]org, dorareco[.]net, naturadeco[.]net, cseconline[.]org, vnptgroup[.]it.com.
Weaknesses (CWE)
CWE-426, CWE-506, CWE-829
Target sectors: government, diplomatic, defense, foreign_affairs
Target regions: Europe, Iceland, Hungary, Belgium, Southeast Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1566.001, T1566.002, T1127.001, T1204.002, T1547.001, T1574.002, T1027.002, T1036.005, T1620, T1070.004