# PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384)

> China-aligned threat actor (Mustang Panda / UNC6384 cluster) delivers PlugX RAT via spear-phishing 'Meeting Invitation' email impersonating the Iceland Ministry of Foreign Affairs. Infection chain: MSBuild.exe LOLBIN executes .csproj downloading legitimate G DATA antivirus executable (Avk.exe) which sideloads malicious Avk.dll (Korplug/PlugX variant). Encrypted payload in AVKTray.dat decrypted via XOR 0x4F. RC4-encrypted configuration with key 'fzsbnWTgLLq'. C2 at decoraat[.]net:443 over HTTPS. DJB2 and ROL-19 API hashing for evasion. Part of broader UNC6384 European diplomatic targeting campaign including ZDI-CAN-25373 exploitation.

- **Published:** 2026-02-27T23:47:00Z
- **Last reviewed:** 2026-02-27T23:47:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0153
- **ID:** TL-2026-0153
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A China-aligned threat actor operating within the Mustang Panda / UNC6384 cluster has deployed a PlugX RAT variant through a spear-phishing campaign using 'Meeting Invitation' lures impersonating the Iceland Ministry of Foreign Affairs. This campaign was analyzed by Lab52 (S2 Grupo) and complements IIJ-SECT's analysis of the STATICPLUGIN downloader used by UNC6384.

The infection chain begins with a phishing email containing two links: one redirecting to the legitimate Iceland Ministry of Foreign Affairs website (stjornarradid.is) for credibility, and another downloading a ZIP archive containing two files. The ZIP (SHA256: 29cd44aa) contains Invitation_Letter_No.02_2026.csproj (a MSBuild project script) and Invitation_Letter_No.02_2026.exe (a renamed copy of MSBuild.exe used as a LOLBIN). When the victim executes the .exe, MSBuild processes the .csproj file which contains three Base64-encoded download URLs pointing to onedow.gesecole[.]net/download.

Three files are downloaded: (1) AVK.exe — a legitimate G DATA Antivirus executable (SHA256: 8421e799, 943KB), digitally signed, (2) Avk.dll — the PlugX/Korplug loader (SHA256: 46314092, 5KB), and (3) AVKTray.dat — an XOR-encrypted payload (SHA256: e7ed0cd4, 73KB). All files are renamed with random filenames upon download. A decoy PDF document is displayed to the victim during execution.

The DLL sideloading chain works because AVK.exe requires Avk.dll at runtime. The malicious Avk.dll obtains the payload filename (AVKTray.dat) from an XOR-encoded string in the .rdata section using key 0x7F. It then decrypts AVKTray.dat using XOR with key 0x4F. The decrypted payload contains the PlugX RAT with an embedded decoy PDF in the overlay section.

Avk.dll uses DJB2-based API hashing to resolve module and function addresses — identified hashes include 0x7040EE75 (Kernel32.dll), 0x22D3B5ED (ntdll.dll), with specific API hashes for NtCreateFile, NtQueryInformationFile, NtClose, ReadFile, NtTerminateProcess, NtProtectVirtualMemory, and RtlRegisterWait. The injected PlugX payload uses a different API hashing algorithm based on ROL-19 (rotate-left 19 bits) plus cumulative character summation, resolving APIs from kernel32.dll, ntdll.dll, kernelbase.dll, winhttp.dll, and ws2_32.dll.

The PlugX configuration is RC4-encrypted in the .data section. The RC4 key is 11 bytes: 'fzsbnWTgLLq' (from the 12-byte string 'fzsbnWTgLLqp' truncated to the length field value 0x0B). The decrypted configuration is further encoded using a custom XOR-based algorithm where block_length and config_head_value parameters control decoding. The C2 domain decoraat[.]net communicates over HTTPS port 443 (BB01 indicator).

Persistence is achieved via the Run registry key 'G DATA' at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, executing Avk.exe with numeric arguments from C:\Users\Public\GDatas\.

IIJ-SECT independently analyzed a related STATICPLUGIN variant (Browser_Updater.exe) that downloads an MSI file from 45.251.243[.]210 (former PlugX C2) deploying the same Avk.exe/Avk.dll/AVKTray.dat triad. Their sample's RC4 key was 'VOphJo' (6 bytes from 'VOphJokPpbbQ'), C2 domain fruitbrat[.]com:443 (real IP likely 108.165.255[.]97). The STATICPLUGIN was code-signed with a certificate from Chinese company Shanxi Rongsheng Yuan Kemao Co., Ltd. — the same certificate was used to sign ValleyRAT malware in September 2025.

Arctic Wolf documented UNC6384's broader European diplomatic targeting campaign exploiting ZDI-CAN-25373 (Windows shortcut vulnerability) against Hungarian, Belgian, Serbian, Italian, and Dutch diplomatic entities. Their campaign used Canon printer utilities for DLL sideloading (cnmpaui.exe/cnmpaui.dll/cnmplog.dat) with additional C2 domains: racineupci[.]org, dorareco[.]net, naturadeco[.]net, cseconline[.]org, vnptgroup[.]it.com.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1127.001 MSBuild
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1070.004 File Deletion
- T1497.001 System Checks
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1090.003 Multi-hop Proxy
- T1583.001 Domains
- T1608.001 Upload Malware
- T1588.003 Code Signing Certificates
- T1056.001 Keylogging
- T1113 Screen Capture

## Sources

- [Lab52: PlugX Meeting Invitation via MSBuild and GDATA](https://lab52.io/blog/plugx-meeting-invitation-via-msbuild-and-gdata/)
- [IIJ-SECT: PlugX executed via STATICPLUGIN (latest variant analysis)](https://sect.iij.ad.jp/blog/2026/02/plugx-executed-via-staticplugin/)
- [Arctic Wolf: UNC6384 Weaponizes ZDI-CAN-25373 to Deploy PlugX](https://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/)
- [Google GTIG: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats](https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats)
- [Hunt.io: Unmasking PlugX Activity via Certificates and Redirects](https://hunt.io/blog/unmasking-adversary-infrastructure-how-certificates-and-redirects-exposed-earth-baxia-and-plugx-activity)
- [ESET: Mustang Panda Hodur — Old Tricks New Korplug Variant](https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/)
- [Malpedia: PlugX](https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0153