SolidPDFCreator: Mustang Panda Stage-1 Backdoor Targeting India via DLL Side-Loading

SolidPDFCreator (TL-2026-1292), also tracked as SolidPDFCreator, is a high-severity malware campaign, first published 2026-07-14. It is attributed to Mustang Panda (China) with high confidence, affects Microsoft Windows (all supported versions), maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1292

Threat ID
TL-2026-1292
Also known as
SolidPDFCreator, Target India - Campaign 3
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-14
Last reviewed
2026-07-14
Attribution
Mustang Panda
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government administration, defense, energy, banking, diplomatic
Target regions
india, South Asia
Detection rules
9
Indicators of compromise
26

Malware and tooling in SolidPDFCreator

Malware and tooling: LOTUSLITE, MINIRECON, PlugX, SHARDLOADER, SolidPDFCreator, TONESHELL - S1239, ZOHOMURK, Cobalt Strike

Mustang Panda (China-nexus APT) is spear-phishing Indian targets with ZIP attachments that DLL side-load a malicious SolidPDFCreator.dll stage-1 backdoor into C:\ProgramData\IDM\logs\, gaining SYSTEM-level persistence via a scheduled task and executing an XOR-obfuscated shellcode payload in RWX memory to evade sandboxes.

How SolidPDFCreator works

In July 2026, researchers at the kienmanowar Blog documented a new Mustang Panda stage-1 backdoor tracked as "SolidPDFCreator," part of a campaign labeled "Target India – Campaign 3." The infection begins with a spear-phishing email carrying a ZIP attachment named "Letter to His Excellency the President.zip" that uses double-extension/hidden-extension obfuscation to trick the victim into executing a legitimate-looking installer (MediumInstStart.exe) alongside a malicious DLL (SolidPDFCreator.dll). Because the legitimate loader binary searches its own directory before trusted system paths, the malicious DLL is loaded instead of (or ahead of) the genuine library — a classic DLL search-order hijack / side-loading technique long associated with Mustang Panda's PlugX, TONESHELL and related toolsets.

Once loaded, SolidPDFCreator drops itself and its loader copy into C:\ProgramData\IDM\logs\, installs a scheduled task named MediumNetMonIt (trigger ID DailyTriggerId) to run with SYSTEM-level privilege on a daily basis, and creates a named event/mutex (uydgcfteionxcfd) to prevent multiple concurrent instances. The DLL's real entry point is exposed through the C++-mangled export GetSPApp (?GetSPApp@@YAAAVCSPApp@@XZ), which dispatches to internal installer/loader logic (Install_CopyMalwareToIDMLogs, IsInstalledInIDMLogs).

The payload itself is protected by a 34-byte cyclic XOR key (yrty!@#123$09*gdt%dgt$874Tydghsbyr) applied across 186 individually-scrambled 187-byte chunks, yielding a 34,816-byte shellcode blob. At execution time the malware allocates RWX memory via VirtualAlloc + VirtualProtect(PAGE_EXECUTE_READWRITE) and abuses the EnumSystemLocalesA() Windows API as a callback-execution primitive to redirect control flow into the decrypted shellcode at offset base+0xD0 — a technique intended to defeat behavioral sandboxes that hook more conventional execution APIs. The shellcode resolves further Windows APIs via PEB-walk export hashing rather than static imports, further complicating static and dynamic analysis.

Mustang Panda (tracked under many vendor names — TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad; MITRE ATT&CK G0129) is a China-nexus espionage actor active since at least 2012, whose long-running mission is collection of diplomatic, political, military and economic intelligence for the Chinese state. The group has repeatedly targeted Indian government, defense, and now energy-sector entities throughout 2026: a June 2026 campaign delivered SHARDLOADER, MINIRECON and ZOHOMURK (the latter abusing Zoho WorkDrive as a C2 channel) against Indian government and energy-sector victims interested in India-Taiwan defense ties and hydropower plans, while a separate April 2026 wave used a LOTUSLITE variant against Indian banks and South Korean policy circles. SolidPDFCreator represents a further diversification of Mustang Panda's stage-1 loader toolkit against the same strategic target set, continuing the group's historical pattern of rapid tooling iteration (PlugX, PUBLOAD, TONESHELL, BOOKWORM, Cobalt Strike, SHARDLOADER, ZOHOMURK, MINIRECON, LOTUSLITE) paired with consistent DLL side-loading tradecraft and scheduled-task persistence.

MITRE ATT&CK techniques used in TL-2026-1292

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job

Privilege Escalation

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1614 System Location Discovery

Initial Access

T1566 Phishing

stealth

T1574 Hijack Execution Flow

Affected products and versions in SolidPDFCreator

  • Microsoft — Windows (all supported versions)
    Vulnerable versions: Windows 10; Windows 11; Windows Server

Remediation for SolidPDFCreator

Immediate actions

  • Block/quarantine emails delivering ZIP attachments with double/hidden file extensions from unverified senders
  • Hunt for the SolidPDFCreator.dll (SHA-256 6c8784885506b0fa3b0543be3c5caec1a4b3c689331d1012847505c61440b2be) and MediumInstStart.exe on endpoints
  • Search for and remove the MediumNetMonIt scheduled task (DailyTriggerId trigger) across the estate
  • Inspect C:\ProgramData\IDM\logs\ for unauthorized DLL/EXE drops
  • Kill/alert on the named event object uydgcfteionxcfd

Workarounds

  • Restrict execution of unsigned DLLs/EXEs dropped into ProgramData subdirectories via application allowlisting
  • Disable or tightly restrict scheduled task creation permissions for standard users

Longer-term hardening

  • Deploy EDR with behavioral detection for RWX memory allocation patterns (VirtualAlloc + VirtualProtect PAGE_EXECUTE_READWRITE) combined with EnumSystemLocalesA callback abuse
  • Enforce application control / DLL side-loading mitigations (Safe DLL Search Mode, code integrity policies) on systems running third-party PDF/installer utilities
  • Monitor scheduled task creation events (Event ID 4698) for SYSTEM-level tasks created outside change-management windows
  • Deploy network-layer detections for known Mustang Panda C2 infrastructure patterns (Zoho WorkDrive abuse, PlugX/TONESHELL C2 profiles)

Weaknesses (CWE) in SolidPDFCreator

CWE-506, CWE-427, CWE-694

Timeline of SolidPDFCreator

  • Mustang Panda deploys a new LOTUSLITE variant against Indian banks and South Korean policy circles, part of the group's broader 2026 India-focused operations.
  • Active beaconing begins from Indian government systems compromised via SHARDLOADER-delivered MINIRECON and ZOHOMURK implants, targeting hydropower and India-Taiwan defense intelligence.
  • Observed beaconing window for the ZOHOMURK/MINIRECON campaign against Indian government entities closes; infrastructure remained operator-tasked throughout.
  • kienmanowar Blog researchers (m4n0w4r and Tran Trung Kien) complete static/dynamic analysis of the SolidPDFCreator.dll sample (PE32 DLL, 210,432 bytes, 822 exported functions), reverse-engineering the XOR-obfuscated shellcode loader and EnumSystemLocalesA callback-abuse execution primitive ahead of publication.
  • Malpedia adds a library entry cataloging SolidPDFCreator as a distinct Mustang Panda malware family.
  • SolidPDFCreator.dll hashes, drop path (C:\ProgramData\IDM\logs\), scheduled task name (MediumNetMonIt), and XOR decryption key publicly documented by researchers.
  • kienmanowar Blog publishes technical QuickNote analysis of the SolidPDFCreator stage-1 backdoor, attributing it to Mustang Panda's 'Target India - Campaign 3.'
  • Threat documented and ingested into the Threadlinqs Intelligence Platform for detection engineering and correlation.

Sources cited for SolidPDFCreator

More in malware

Detection coverage for TL-2026-1292

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1292 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1292

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats