# Mustang Panda PlugX RAT — Multi-Stage Fake Browser Update Chain via G DATA AntiVirus DLL Sideloading (BlueCyber)

> China-aligned espionage actor Mustang Panda is delivering its signature PlugX RAT through a fake browser-update lure. A signed dropper (Browser_Updater.exe) shows a decoy Adobe Acrobat install window, then fetches an MSI masqueraded as a JPEG (iis.jpg) over HTTP that drops a legitimately signed G DATA AntiVirus binary (Avk.exe), a malicious loader (Avk.dll), and an encrypted payload (AVKTray.dat). Avk.exe sideloads Avk.dll, which uses runtime API hashing plus XOR-then-RC4 decryption to manually map PlugX into memory and beacon to C2 over HTTPS.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0658
- **ID:** TL-2026-0658
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is an active Mustang Panda (Chinese state-sponsored) intrusion set documented by BlueCyber from a January 2026 sample, abusing a legitimately signed G DATA AntiVirus executable for DLL sideloading to deploy the PlugX remote access trojan. The campaign continues the group's decade-long tradecraft of signed-binary abuse and layered, multi-stage loaders while introducing a fresh delivery vector and IOC set distinct from prior PlugX activity.

Stage 1 — Initial access and social engineering: The victim receives Browser_Update.zip containing Browser_Updater.exe, a dropper carrying a Chinese company code-signing certificate to appear trustworthy. On launch it renders a fake Adobe Acrobat-styled update window with Install/Cancel buttons. Clicking Install triggers retrieval of the second-stage payload.

Stage 2 — Masqueraded MSI delivery: The dropper downloads iis.jpg (SHA-256 79af67ed343bc45b6a19e4836ebb83f1130243ff98f48465f9a7a807ba4bfa91) from 45.251.243.210 over cleartext HTTP. Despite the .jpg extension the file is a Windows MSI installer package. It unpacks three components: Avk.exe (a legitimately signed G DATA AntiVirus binary, SHA-256 8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99), Avk.dll (the malicious intermediate loader), and AVKTray.dat (the encrypted PlugX payload container). Files stage to %LOCALAPPDATA%\pZhozR\ and persist to %PUBLIC%\GData\.

Stage 3 — DLL sideloading and in-memory execution: Avk.exe is run from the attacker-controlled directory so Windows loads the adjacent malicious Avk.dll instead of the genuine one (search-order/sideloading abuse). Avk.dll resolves Windows APIs via a runtime hashing routine to keep API names out of the import table and static analysis. It reads AVKTray.dat and decrypts the embedded PlugX with an XOR pass followed by RC4 using the key 'VOphJo'. The decrypted PlugX is manually mapped into memory (no payload written to disk) and execution is launched from a Windows threadpool callback to obscure the call origin.

Persistence and C2: PlugX establishes persistence via the Run key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\G Data pointing at Avk.exe with filler arguments, and stores its client identifier under HKCU\Software\Classes\ms-pu\CLSID. A mutex (aumhYjQIQ) prevents duplicate controller instances. The implant beacons to fruitbrat.com:443 over HTTPS using WinHTTP, shaping traffic to mimic Microsoft Edge browsing; a related variant observed in May 2026 targeting Vietnam used dalerocks.com:443. PlugX capabilities include file download/execute, process launch with output capture, chunked file upload/download, file enumeration and deletion, killing diagnostic tooling (e.g. iis.iediagcmd.exe) to evade detection, and plugin loader stubs for additional modules.

Defenders should treat any execution of a G DATA AntiVirus binary from %PUBLIC%\GData\ or %LOCALAPPDATA% subfolders, HTTP retrieval of image-extension files that are actually MSI packages, and the listed registry and network indicators as high-confidence signals of this intrusion.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1569 System Services
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1553 Subvert Trust Controls
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Mustang Panda Deploys PlugX RAT Through Multi-Stage Attack Chain](https://cybersecuritynews.com/mustang-panda-deploys-plugx-rat/)
- [Mustang Panda (G0129) — MITRE ATT&CK Group](https://attack.mitre.org/groups/G0129/)
- [Mustang Panda deploys a new wave of malware targeting Europe — Cisco Talos](https://blog.talosintelligence.com/mustang-panda-targets-europe/)
- [PlugX (Malware Family) — Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx)
- [How PlugX Malware Has Evolved & Adapted — Darktrace](https://www.darktrace.com/blog/plugx-malware-a-rats-race-to-adapt-and-survive)
- [Mustang Panda Deploys Evasive Multi-Stage Malware — Hack The Box](https://www.hackthebox.com/blog/mustang-panda-attack-anatomy)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0658