# SolidPDFCreator: Mustang Panda Stage-1 Backdoor Targeting India via DLL Side-Loading

> Mustang Panda (China-nexus APT) is spear-phishing Indian targets with ZIP attachments that DLL side-load a malicious SolidPDFCreator.dll stage-1 backdoor into C:\ProgramData\IDM\logs\, gaining SYSTEM-level persistence via a scheduled task and executing an XOR-obfuscated shellcode payload in RWX memory to evade sandboxes.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1292
- **ID:** TL-2026-1292
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, researchers at the kienmanowar Blog documented a new Mustang Panda stage-1 backdoor tracked as "SolidPDFCreator," part of a campaign labeled "Target India – Campaign 3." The infection begins with a spear-phishing email carrying a ZIP attachment named "Letter to His Excellency the President.zip" that uses double-extension/hidden-extension obfuscation to trick the victim into executing a legitimate-looking installer (MediumInstStart.exe) alongside a malicious DLL (SolidPDFCreator.dll). Because the legitimate loader binary searches its own directory before trusted system paths, the malicious DLL is loaded instead of (or ahead of) the genuine library — a classic DLL search-order hijack / side-loading technique long associated with Mustang Panda's PlugX, TONESHELL and related toolsets.

Once loaded, SolidPDFCreator drops itself and its loader copy into C:\ProgramData\IDM\logs\, installs a scheduled task named MediumNetMonIt (trigger ID DailyTriggerId) to run with SYSTEM-level privilege on a daily basis, and creates a named event/mutex (uydgcfteionxcfd) to prevent multiple concurrent instances. The DLL's real entry point is exposed through the C++-mangled export GetSPApp (?GetSPApp@@YAAAVCSPApp@@XZ), which dispatches to internal installer/loader logic (Install_CopyMalwareToIDMLogs, IsInstalledInIDMLogs).

The payload itself is protected by a 34-byte cyclic XOR key (yrty!@#123$09*gdt%dgt$874Tydghsbyr) applied across 186 individually-scrambled 187-byte chunks, yielding a 34,816-byte shellcode blob. At execution time the malware allocates RWX memory via VirtualAlloc + VirtualProtect(PAGE_EXECUTE_READWRITE) and abuses the EnumSystemLocalesA() Windows API as a callback-execution primitive to redirect control flow into the decrypted shellcode at offset base+0xD0 — a technique intended to defeat behavioral sandboxes that hook more conventional execution APIs. The shellcode resolves further Windows APIs via PEB-walk export hashing rather than static imports, further complicating static and dynamic analysis.

Mustang Panda (tracked under many vendor names — TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad; MITRE ATT&CK G0129) is a China-nexus espionage actor active since at least 2012, whose long-running mission is collection of diplomatic, political, military and economic intelligence for the Chinese state. The group has repeatedly targeted Indian government, defense, and now energy-sector entities throughout 2026: a June 2026 campaign delivered SHARDLOADER, MINIRECON and ZOHOMURK (the latter abusing Zoho WorkDrive as a C2 channel) against Indian government and energy-sector victims interested in India-Taiwan defense ties and hydropower plans, while a separate April 2026 wave used a LOTUSLITE variant against Indian banks and South Korean policy circles. SolidPDFCreator represents a further diversification of Mustang Panda's stage-1 loader toolkit against the same strategic target set, continuing the group's historical pattern of rapid tooling iteration (PlugX, PUBLOAD, TONESHELL, BOOKWORM, Cobalt Strike, SHARDLOADER, ZOHOMURK, MINIRECON, LOTUSLITE) paired with consistent DLL side-loading tradecraft and scheduled-task persistence.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1574 Hijack Execution Flow
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel

## Sources

- [QuickNote SolidPDFCreator - Mustang Panda Stage-1 Backdoor (Target India)](https://kienmanowar.wordpress.com/2026/07/13/quicknote-solidpdfcreator-mustang-panda-stage-1-backdoor-target-india/)
- [Malpedia library entry: SolidPDFCreator](https://malpedia.caad.fkie.fraunhofer.de/library/16c02ffa-6c8b-490a-a291-535d790772b9/)
- [Mustang Panda (G0129) | MITRE ATT&CK](https://attack.mitre.org/groups/G0129/)
- [Camaro Dragon (Threat Actor) | Malpedia](https://malpedia.caad.fkie.fraunhofer.de/actor/camaro_dragon)
- [Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON](https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/)
- [Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks](https://thehackernews.com/2026/06/mustang-panda-uses-zoho-workdrive-as.html)
- [Same packet, different magic: Mustang Panda hits India's banking sector and Korea geopolitics](https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/)
- [Mustang Panda's New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles](https://thehackernews.com/2026/04/mustang-pandas-new-lotuslite-variant.html)
- [APT PROFILE – MUSTANG PANDA - CYFIRMA](https://www.cyfirma.com/research/apt-profile-mustang-panda/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1292