Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026)
Mustang Panda Deploys PlugX RAT via Multi-Stage CHM (TL-2026-0219), also tracked as Mustang Panda Persian Gulf PlugX Campaign March 2026, is a high-severity advanced persistent threat campaign, first published 2026-03-12 and last reviewed 2026-08-06. It is attributed to Mustang Panda (China) with medium confidence, affects Microsoft Windows, maps to 28 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0219
- Threat ID
- TL-2026-0219
- Also known as
- Mustang Panda Persian Gulf PlugX Campaign March 2026, DOPLUGS Variant Campaign
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- 2026-03-12
- Last reviewed
- 2026-08-06
- Attribution
- Mustang Panda
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, energy, diplomatic, ngo, think-tank
- Target regions
- Persian Gulf, Bahrain, GCC Countries, Middle East
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-08-06
Malware and tooling in Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
Malware and tooling: DOPLUGS variant, PlugX, PlugX
A China-nexus threat actor assessed with medium confidence as Mustang Panda is actively targeting Persian Gulf countries with the PlugX backdoor. The campaign uses Arabic-language geopolitical lures, multi-stage LNK/CHM sideloading chains, RC4-encrypted shellcode with control flow flattening and mixed boolean arithmetic obfuscation, and reflective DLL injection to deploy PlugX with C2 over HTTPS, TCP, UDP, and DNS-over-HTTPS.
How Mustang Panda Deploys PlugX RAT via Multi-Stage CHM works
Zscaler ThreatLabz observed a China-nexus threat actor targeting countries in the Persian Gulf region with the PlugX backdoor beginning March 1, 2026, coinciding with renewed Middle East geopolitical tensions. The campaign is attributed with medium confidence to Mustang Panda (also tracked as Stately Taurus, Bronze President, Earth Preta, TA416, PKPLUG, Camaro Dragon, RedDelta, and Twill Typhoon) based on heavy code overlaps with the 2024 DOPLUGS campaign, identical RC4 configuration decryption keys, control flow flattening patterns consistent with prior Mustang Panda activity, and the exclusive use of PlugX — a backdoor used only by China-nexus actors.
The attack chain begins with a ZIP archive (photo_2026-03-01_01-20-48.zip) containing an LNK file masquerading as a PDF using a double file extension (.pdf.lnk). The LNK uses cURL to download a malicious CHM file from the staging domain 360printsol.com and invokes hh.exe with the -decompile flag to extract its contents. The CHM contains a Stage 2 LNK (0.lnk), a decoy Arabic-language PDF depicting missile strikes against a US base in Bahrain, and a TAR archive containing the sideloading payload.
The TAR extracts to %AppData%\BaiduNetdisk\ and includes three files: ShellFolder.exe (a legitimate binary abused for DLL sideloading), ShellFolderDepend.dll (the malicious loader DLL), and Shelter.ex (encrypted shellcode storage). When ShellFolder.exe executes with the --path a argument, it automatically loads ShellFolderDepend.dll via DLL sideloading.
ShellFolderDepend.dll establishes persistence through two mechanisms: a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BaiNetdisk) and a Windows service named DesktopDialogBroker with display name "Microsoft Desktop Dialog Broker" installed under %ProgramFiles%\Microsoft\Display Broker. The DLL then reads and decrypts the Shelter.ex file using an index-based XOR algorithm with KEY_BASE 0x34.
The decrypted shellcode is 32-bit, position-independent, and heavily obfuscated using control flow flattening (CFF) implemented as a state machine where a state variable determines the next execution block, and mixed boolean arithmetic (MBA) that obscures XOR operations with the pattern (~x & K) | (x & ~K). API strings are encrypted and resolved dynamically at runtime.
The shellcode decrypts an embedded PlugX payload using a custom PRNG with seed 0xc56dd7ea and the state update formula: state = (state + (state >> 3) + 0x13233366) & 0xFFFFFFFF. The decrypted payload is then decompressed using LZNT1 via RtlDecompressBuffer.
The PlugX backdoor is loaded via reflective DLL injection without writing to disk. As an anti-forensic measure, the IMAGE_DOS_HEADER is overwritten with random ASCII, the DOS stub is replaced with junk data, and the PE signature is corrupted (0x50453434 changed to 0x19310000), while the e_lfanew pointer at offset 0x78 and COFF File Header remain intact to allow reflective loading.
The ShellFolderDepend.dll installs inline API hooks on GetCommandLineW (spoofs return value as "ShellFolder.exe 701 0") and CreateProcessAsUserW (restores original bytes then calls Sleep indefinitely) to control execution flow.
PlugX configuration is decrypted in two stages: first a custom algorithm processing 4-byte parts via arithmetic operations, then RC4 with the key qwedfgx202211 applied to individual fields. This RC4 key is identical to the one observed in the 2024 DOPLUGS campaign. The shellcode loader uses RC4 with key 20260301@@@ (format YYYYMMDD@@@).
The PlugX C2 communicates with 91.193.17.117 on port 443 using HTTPS, with additional support for TCP, UDP, and DNS-over-HTTPS via dns.google/dns-query. C2 traffic is encrypted with RC4 using the key VD*1^N1OCLtAGM$U. The backdoor supports 10 command IDs including system information collection, plugin management, LAN scanning, and proxying to other PlugX instances. It includes 13 plugins: Disk, Process, Service, RegEdit, Netstat, Nethood, Option, PortMap, Screen, Shell, Telnet, SQL, and Keylog.
PlugX performs discovery by fingerprinting the system, checking for security software (specifically bdagent.exe for Bitdefender), and searching for files with extensions .doc*, .pdf, .xls*, .ppt*, .mp3, and .wav modified within the last 30 days. The backdoor also includes a Fodhelper-based UAC bypass for privilege escalation.
MITRE ATT&CK techniques used in TL-2026-0219
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1620 Reflective Code Loading
execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution; T1574 Hijack Execution Flow
privilege-escalation
T1548 Abuse Elevation Control Mechanism
initial-access
resource-development
T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Affected products and versions in Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022
Remediation for Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
Immediate actions
- Block IP 91.193.17.117 at perimeter firewalls and proxy servers
- Block domain 360printsol.com at DNS and web proxy level
- Hunt for presence of ShellFolderDepend.dll and Shelter.ex in %AppData%\BaiduNetdisk\
- Check for registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BaiNetdisk
- Check for Windows service DesktopDialogBroker / Microsoft Desktop Dialog Broker
- Search for files matching SHA256 hashes listed in IOCs across all endpoints
- Block hh.exe from decompiling CHM files from non-standard locations via AppLocker or WDAC
Workarounds
- Disable hh.exe -decompile functionality via Group Policy if not required
- Block ZIP files containing LNK files at email and web gateways
- Restrict cURL execution to authorized processes only
Longer-term hardening
- Deploy EDR with behavioral detection for DLL sideloading and reflective injection
- Implement application allowlisting to prevent unsigned DLL execution
- Monitor for DNS-over-HTTPS to dns.google/dns-query from unexpected processes
- Restrict hh.exe execution via application control policies
- Enable PowerShell script block logging and command line auditing
- Segment networks to limit lateral movement via PlugX proxy capabilities
- Deploy deception technology targeting PlugX plugin behaviors (Disk, Shell, Keylog)
Timeline of Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
- Mustang Panda first observed conducting cyber espionage operations, active since at least 2012
- DOPLUGS campaign documented using identical RC4 key qwedfgx202211 and similar code patterns now seen in this campaign
- International law enforcement operation disrupted Mustang Panda PlugX infrastructure, but group demonstrated strategic resilience by retooling
- C2 infrastructure at 91.193.17.117:443 observed actively handling PlugX callbacks from compromised Persian Gulf targets
- Arabic-language social engineering lure created depicting Iranian missile strikes against US base in Bahrain, weaponizing current geopolitical events
- Zscaler ThreatLabz observed new China-nexus activity targeting Persian Gulf region with PlugX, coinciding with renewed Middle East geopolitical tensions
- Zscaler ThreatLabz publishes detailed technical analysis of the Mustang Panda Persian Gulf PlugX campaign with full IOCs and MITRE mappings
- As of 2026-05-29, this Mustang Panda PlugX campaign remains a valid threat: it has no CVE to patch (phishing + DLL-sideloading APT tradecraft), and Mustang Panda is confirmed still operating through April-May 2026 (Picus, Talos, Darktrace, Unit 42). The specific March-2026 Persian Gulf wave with hardcoded C2 91.193.17.117/360printsol.com is now published and likely burned, so it is downgraded to MONITORING rather than disrupted.
Update history for TL-2026-0219
- 2026-08-06 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 5 community-related indicator(s).
Sources cited for Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
- Zscaler ThreatLabz: China-nexus Threat Actor Targets Persian Gulf Region With PlugX
- MITRE ATT&CK - Mustang Panda (G0129)
- MITRE ATT&CK - PlugX (S0013)
- Malpedia - Mustang Panda Threat Actor Profile
- CYFIRMA APT Profile - Mustang Panda
- Palo Alto Unit 42 - Stately Taurus Attacks SE Asian Government
- Cisco Talos - Mustang Panda Deploys New Wave of Malware Targeting Europe
- Picus Security - Mustang Panda Windows Endpoint Campaign
Threats related to Mustang Panda Deploys PlugX RAT via Multi-Stage CHM
- Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict Themes
- Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets Indian Banking (HDFC) and South Korean Policy Circles
- ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types)
Detection coverage for TL-2026-0219
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0219 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.