Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026) — Threadlinqs Intelligence
As of 2026-05-30, Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026) is a high-severity apt threat attributed to Mustang Panda (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0219 · Severity: HIGH · Status: MONITORING · Category: APT
Attribution: Mustang Panda · China · ESPIONAGE
A China-nexus threat actor assessed with medium confidence as Mustang Panda is actively targeting Persian Gulf countries with the PlugX backdoor. The campaign uses Arabic-language geopolitical lures,
Zscaler ThreatLabz observed a China-nexus threat actor targeting countries in the Persian Gulf region with the PlugX backdoor beginning March 1, 2026, coinciding with renewed Middle East geopolitical tensions. The campaign is attributed with medium confidence to Mustang Panda (also tracked as Stately Taurus, Bronze President, Earth Preta, TA416, PKPLUG, Camaro Dragon, RedDelta, and Twill Typhoon) based on heavy code overlaps with the 2024 DOPLUGS campaign, identical RC4 configuration decryption keys, control flow flattening patterns consistent with prior Mustang Panda activity, and the exclusive use of PlugX — a backdoor used only by China-nexus actors.
The attack chain begins with a ZIP archive (photo_2026-03-01_01-20-48.zip) containing an LNK file masquerading as a PDF using a double file extension (.pdf.lnk). The LNK uses cURL to download a malicious CHM file from the staging domain 360printsol.com and invokes hh.exe with the -decompile flag to extract its contents. The CHM contains a Stage 2 LNK (0.lnk), a decoy Arabic-language PDF depicting missile strikes against a US base in Bahrain, and a TAR archive containing the sideloading payload.
The TAR extracts to %AppData%\BaiduNetdisk\ and includes three files: ShellFolder.exe (a legitimate binary abused for DLL sideloading), ShellFolderDepend.dll (the malicious loader DLL), and Shelter.ex (encrypted shellcode storage). When ShellFolder.exe executes with the --path a argument, it automatically loads ShellFolderDepend.dll via DLL sideloading.
ShellFolderDepend.dll establishes persistence through two mechanisms: a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BaiNetdisk) and a Windows service named DesktopDialogBroker with display name "Microsoft Desktop Dialog Broker" installed under %ProgramFiles%\Microsoft\Display Broker. The DLL then reads and decrypts the Shelter.ex file using an index-based XOR algorithm with KEY_BASE 0x34.
The decrypted shellcode is 32-bit, position-independent, and heavily obfuscated using control flow flattening (CFF) implemented as a state machine where a state variable determines the next execution block, and mixed boolean arithmetic (MBA) that obscures XOR operations with the pattern (~x & K) | (x & ~K). API strings are encrypted and resolved dynamically at runtime.
The shellcode decrypts an embedded PlugX payload using a custom PRNG with seed 0xc56dd7ea and the state update formula: state = (state + (state >> 3) + 0x13233366) & 0xFFFFFFFF. The decrypted payload is then decompressed using LZNT1 via RtlDecompressBuffer.
The PlugX backdoor is loaded via reflective DLL injection without writing to disk. As an anti-forensic measure, the IMAGE_DOS_HEADER is overwritten with random ASCII, the DOS stub is replaced with junk data, and the PE signature is corrupted (0x50453434 changed to 0x19310000), while the e_lfanew pointer at offset 0x78 and COFF File Header remain intact to allow reflective loading.
The ShellFolderDepend.dll installs inline API hooks on GetCommandLineW (spoofs return value as "ShellFolder.exe 701 0") and CreateProcessAsUserW (restores original bytes then calls Sleep indefinitely) to control execution flow.
PlugX configuration is decrypted in two stages: first a custom algorithm processing 4-byte parts via arithmetic operations, then RC4 with the key qwedfgx202211 applied to individual fields. This RC4 key is identical to the one observed in the 2024 DOPLUGS campaign. The shellcode loader uses RC4 with key 20260301@@@ (format YYYYMMDD@@@).
The PlugX C2 communicates with 91.193.17.117 on port 443 using HTTPS, with additional support for TCP, UDP, and DNS-over-HTTPS via dns.google/dns-query. C2 traffic is encrypted with RC4 using the key VD*1^N1OCLtAGM$U. The backdoor supports 10 command IDs including system information collection, plugin management, LAN scanning, and proxying to other PlugX instances. It includes 13 plugins: Disk, Process, Service, RegEdit, Netstat, Nethood, Option, PortMap, Screen, Shell,
Target sectors: government, defense, energy, diplomatic, ngo, think-tank
Target regions: Persian Gulf, Bahrain, GCC Countries, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1587, T1588, T1608, T1566, T1204, T1059, T1106, T1547, T1543, T1548