# Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026)

> A China-nexus threat actor assessed with medium confidence as Mustang Panda is actively targeting Persian Gulf countries with the PlugX backdoor. The campaign uses Arabic-language geopolitical lures, multi-stage LNK/CHM sideloading chains, RC4-encrypted shellcode with control flow flattening and mixed boolean arithmetic obfuscation, and reflective DLL injection to deploy PlugX with C2 over HTTPS, TCP, UDP, and DNS-over-HTTPS.

- **Published:** 2026-03-12T12:00:00Z
- **Last reviewed:** 2026-08-06T18:51:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0219
- **ID:** TL-2026-0219
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Zscaler ThreatLabz observed a China-nexus threat actor targeting countries in the Persian Gulf region with the PlugX backdoor beginning March 1, 2026, coinciding with renewed Middle East geopolitical tensions. The campaign is attributed with medium confidence to Mustang Panda (also tracked as Stately Taurus, Bronze President, Earth Preta, TA416, PKPLUG, Camaro Dragon, RedDelta, and Twill Typhoon) based on heavy code overlaps with the 2024 DOPLUGS campaign, identical RC4 configuration decryption keys, control flow flattening patterns consistent with prior Mustang Panda activity, and the exclusive use of PlugX — a backdoor used only by China-nexus actors.

The attack chain begins with a ZIP archive (photo_2026-03-01_01-20-48.zip) containing an LNK file masquerading as a PDF using a double file extension (.pdf.lnk). The LNK uses cURL to download a malicious CHM file from the staging domain 360printsol.com and invokes hh.exe with the -decompile flag to extract its contents. The CHM contains a Stage 2 LNK (0.lnk), a decoy Arabic-language PDF depicting missile strikes against a US base in Bahrain, and a TAR archive containing the sideloading payload.

The TAR extracts to %AppData%\BaiduNetdisk\ and includes three files: ShellFolder.exe (a legitimate binary abused for DLL sideloading), ShellFolderDepend.dll (the malicious loader DLL), and Shelter.ex (encrypted shellcode storage). When ShellFolder.exe executes with the --path a argument, it automatically loads ShellFolderDepend.dll via DLL sideloading.

ShellFolderDepend.dll establishes persistence through two mechanisms: a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BaiNetdisk) and a Windows service named DesktopDialogBroker with display name "Microsoft Desktop Dialog Broker" installed under %ProgramFiles%\Microsoft\Display Broker. The DLL then reads and decrypts the Shelter.ex file using an index-based XOR algorithm with KEY_BASE 0x34.

The decrypted shellcode is 32-bit, position-independent, and heavily obfuscated using control flow flattening (CFF) implemented as a state machine where a state variable determines the next execution block, and mixed boolean arithmetic (MBA) that obscures XOR operations with the pattern (~x & K) | (x & ~K). API strings are encrypted and resolved dynamically at runtime.

The shellcode decrypts an embedded PlugX payload using a custom PRNG with seed 0xc56dd7ea and the state update formula: state = (state + (state >> 3) + 0x13233366) & 0xFFFFFFFF. The decrypted payload is then decompressed using LZNT1 via RtlDecompressBuffer.

The PlugX backdoor is loaded via reflective DLL injection without writing to disk. As an anti-forensic measure, the IMAGE_DOS_HEADER is overwritten with random ASCII, the DOS stub is replaced with junk data, and the PE signature is corrupted (0x50453434 changed to 0x19310000), while the e_lfanew pointer at offset 0x78 and COFF File Header remain intact to allow reflective loading.

The ShellFolderDepend.dll installs inline API hooks on GetCommandLineW (spoofs return value as "ShellFolder.exe 701 0") and CreateProcessAsUserW (restores original bytes then calls Sleep indefinitely) to control execution flow.

PlugX configuration is decrypted in two stages: first a custom algorithm processing 4-byte parts via arithmetic operations, then RC4 with the key qwedfgx202211 applied to individual fields. This RC4 key is identical to the one observed in the 2024 DOPLUGS campaign. The shellcode loader uses RC4 with key 20260301@@@ (format YYYYMMDD@@@).

The PlugX C2 communicates with 91.193.17.117 on port 443 using HTTPS, with additional support for TCP, UDP, and DNS-over-HTTPS via dns.google/dns-query. C2 traffic is encrypted with RC4 using the key VD*1^N1OCLtAGM$U. The backdoor supports 10 command IDs including system information collection, plugin management, LAN scanning, and proxying to other PlugX instances. It includes 13 plugins: Disk, Process, Service, RegEdit, Netstat, Nethood, Option, PortMap, Screen, Shell, Telnet, SQL, and Keylog.

PlugX performs discovery by fingerprinting the system, checking for security software (specifically bdagent.exe for Bitdefender), and searching for files with extensions .doc*, .pdf, .xls*, .ppt*, .mp3, and .wav modified within the last 30 days. The backdoor also includes a Fodhelper-based UAC bypass for privilege escalation.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1090 Proxy
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1005 Data from Local System
- T1056 Input Capture
- T1113 Screen Capture

## Sources

- [Zscaler ThreatLabz: China-nexus Threat Actor Targets Persian Gulf Region With PlugX](https://www.zscaler.com/blogs/security-research/china-nexus-threat-actor-targets-persian-gulf-region-plugx)
- [MITRE ATT&CK - Mustang Panda (G0129)](https://attack.mitre.org/groups/G0129/)
- [MITRE ATT&CK - PlugX (S0013)](https://attack.mitre.org/software/S0013/)
- [Malpedia - Mustang Panda Threat Actor Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/mustang_panda)
- [CYFIRMA APT Profile - Mustang Panda](https://www.cyfirma.com/research/apt-profile-mustang-panda/)
- [Palo Alto Unit 42 - Stately Taurus Attacks SE Asian Government](https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/)
- [Cisco Talos - Mustang Panda Deploys New Wave of Malware Targeting Europe](https://blog.talosintelligence.com/mustang-panda-targets-europe/)
- [Picus Security - Mustang Panda Windows Endpoint Campaign](https://www.picussecurity.com/resource/blog/breaking-down-mustang-panda-windows-endpoint-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0219