Mustang Panda PlugX RAT — Multi-Stage Fake Browser Update Chain via G DATA AntiVirus DLL Sideloading (BlueCyber)
Mustang Panda PlugX RAT (TL-2026-0658), also tracked as BlueCyber PlugX Browser Update chain, is a high-severity malware campaign, first published 2026-06-02. It is attributed to Mustang Panda (China) with high confidence, affects Microsoft Windows, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0658
- Threat ID
- TL-2026-0658
- Also known as
- BlueCyber PlugX Browser Update chain, G DATA Avk.exe sideloading PlugX
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-02
- Last reviewed
- 2026-06-02
- Attribution
- Mustang Panda
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, ngo, think-tanks, defense, research
- Target regions
- Europe, Asia, Southeast Asia, Vietnam
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Mustang Panda PlugX RAT
Malware and tooling: PlugX
China-aligned espionage actor Mustang Panda is delivering its signature PlugX RAT through a fake browser-update lure. A signed dropper (Browser_Updater.exe) shows a decoy Adobe Acrobat install window, then fetches an MSI masqueraded as a JPEG (iis.jpg) over HTTP that drops a legitimately signed G DATA AntiVirus binary (Avk.exe), a malicious loader (Avk.dll), and an encrypted payload (AVKTray.dat). Avk.exe sideloads Avk.dll, which uses runtime API hashing plus XOR-then-RC4 decryption to manually map PlugX into memory and beacon to C2 over HTTPS.
How Mustang Panda PlugX RAT works
This is an active Mustang Panda (Chinese state-sponsored) intrusion set documented by BlueCyber from a January 2026 sample, abusing a legitimately signed G DATA AntiVirus executable for DLL sideloading to deploy the PlugX remote access trojan. The campaign continues the group's decade-long tradecraft of signed-binary abuse and layered, multi-stage loaders while introducing a fresh delivery vector and IOC set distinct from prior PlugX activity.
Stage 1 — Initial access and social engineering: The victim receives Browser_Update.zip containing Browser_Updater.exe, a dropper carrying a Chinese company code-signing certificate to appear trustworthy. On launch it renders a fake Adobe Acrobat-styled update window with Install/Cancel buttons. Clicking Install triggers retrieval of the second-stage payload.
Stage 2 — Masqueraded MSI delivery: The dropper downloads iis.jpg (SHA-256 79af67ed343bc45b6a19e4836ebb83f1130243ff98f48465f9a7a807ba4bfa91) from 45.251.243.210 over cleartext HTTP. Despite the .jpg extension the file is a Windows MSI installer package. It unpacks three components: Avk.exe (a legitimately signed G DATA AntiVirus binary, SHA-256 8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99), Avk.dll (the malicious intermediate loader), and AVKTray.dat (the encrypted PlugX payload container). Files stage to %LOCALAPPDATA%\pZhozR\ and persist to %PUBLIC%\GData\.
Stage 3 — DLL sideloading and in-memory execution: Avk.exe is run from the attacker-controlled directory so Windows loads the adjacent malicious Avk.dll instead of the genuine one (search-order/sideloading abuse). Avk.dll resolves Windows APIs via a runtime hashing routine to keep API names out of the import table and static analysis. It reads AVKTray.dat and decrypts the embedded PlugX with an XOR pass followed by RC4 using the key 'VOphJo'. The decrypted PlugX is manually mapped into memory (no payload written to disk) and execution is launched from a Windows threadpool callback to obscure the call origin.
Persistence and C2: PlugX establishes persistence via the Run key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\G Data pointing at Avk.exe with filler arguments, and stores its client identifier under HKCU\Software\Classes\ms-pu\CLSID. A mutex (aumhYjQIQ) prevents duplicate controller instances. The implant beacons to fruitbrat.com:443 over HTTPS using WinHTTP, shaping traffic to mimic Microsoft Edge browsing; a related variant observed in May 2026 targeting Vietnam used dalerocks.com:443. PlugX capabilities include file download/execute, process launch with output capture, chunked file upload/download, file enumeration and deletion, killing diagnostic tooling (e.g. iis.iediagcmd.exe) to evade detection, and plugin loader stubs for additional modules.
Defenders should treat any execution of a G DATA AntiVirus binary from %PUBLIC%\GData\ or %LOCALAPPDATA% subfolders, HTTP retrieval of image-extension files that are actually MSI packages, and the listed registry and network indicators as high-confidence signals of this intrusion.
MITRE ATT&CK techniques used in TL-2026-0658
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Execution
T1106 Native API; T1204 User Execution; T1569 System Services
Initial Access
Persistence
T1547 Boot or Logon Autostart Execution
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in Mustang Panda PlugX RAT
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - G DATA — G DATA AntiVirus (Avk.exe binary abused as sideloading host)
Vulnerable versions: signed Avk.exe component
Remediation for Mustang Panda PlugX RAT
Immediate actions
- Block C2 domains fruitbrat.com and dalerocks.com and IP 45.251.243.210 at the perimeter and DNS layer
- Hunt for the registry Run key 'G Data' under HKCU pointing at Avk.exe, and for HKCU\Software\Classes\ms-pu\CLSID
- Alert on any G DATA AntiVirus binary (Avk.exe) executing from %PUBLIC%\GData\ or %LOCALAPPDATA%\pZhozR\ rather than its installed Program Files path
- Quarantine Browser_Update.zip, Browser_Updater.exe, iis.jpg, Avk.dll, and AVKTray.dat by hash/name across the fleet
Workarounds
- Restrict outbound HTTP from user endpoints; force web traffic through inspecting proxies
- Disable execution of binaries from user-writable directories via WDAC/AppLocker policy
Longer-term hardening
- Deploy EDR with behavioral DLL-sideloading and reflective/manual-mapping detection
- Enforce application allowlisting so signed binaries only execute from approved install paths
- Block or alert on MSI/PE files delivered with mismatched image extensions over HTTP
- User awareness training on fake browser/Adobe update lures
Weaknesses (CWE) in Mustang Panda PlugX RAT
CWE-427, CWE-426
Timeline of Mustang Panda PlugX RAT
- BlueCyber obtains and analyzes a January 2026 sample of the Mustang Panda PlugX fake-browser-update chain abusing the signed G DATA AntiVirus binary Avk.exe.
- Browser_Update.zip and iis.jpg flagged malicious by multiple vendors on VirusTotal.
- Related PlugX variant observed targeting Vietnam, beaconing to alternate C2 dalerocks.com:443.
- BeaconBeagle queried for C2 indicators 45.251.243.210, fruitbrat.com, and dalerocks.com — no known C2-framework configuration match returned.
- Threadlinqs Intelligence documents the full exploit chain, MITRE mapping, and IOC set as TL-2026-0658.
- Cyber Security News publishes public reporting on the multi-stage PlugX delivery chain.
Sources cited for Mustang Panda PlugX RAT
- Mustang Panda Deploys PlugX RAT Through Multi-Stage Attack Chain
- Mustang Panda (G0129) — MITRE ATT&CK Group
- Mustang Panda deploys a new wave of malware targeting Europe — Cisco Talos
- PlugX (Malware Family) — Malpedia
- How PlugX Malware Has Evolved & Adapted — Darktrace
- Mustang Panda Deploys Evasive Multi-Stage Malware — Hack The Box
Threats related to Mustang Panda PlugX RAT
- Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict Themes
- PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384)
- Fake Claude AI Download Site Delivers Trojanized Installer Deploying PlugX RAT via G DATA DLL Sideloading
- JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets in APAC and Latin America
Detection coverage for TL-2026-0658
As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0658 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.