Mustang Panda Uses LNK and PowerShell to Deploy PlugX RAT

Key Takeaways

• Chinese state-sponsored threat actor Mustang Panda has launched a new cyberattack campaign.
• The campaign uses a multi-stage infection chain, beginning with a fake browser update, to deploy the PlugX Remote Access Trojan (RAT).
• The sophisticated attack leverages DLL sideloading with a legitimate G DATA AntiVirus executable and employs various evasion techniques.
• PlugX provides extensive control over compromised systems, including file manipulation, process execution, and the ability to deploy further malicious modules.

Mustang Panda Unleashes Sophisticated PlugX Campaign Via Multi-Stage Infection Chain

The Chinese state-sponsored advanced persistent threat (APT) group, Mustang Panda, has been observed deploying its signature PlugX Remote Access Trojan (RAT) in a highly sophisticated cyberattack campaign. This operation utilizes a meticulously crafted, multi-stage infection process designed to bypass traditional security measures and establish persistent control over victim systems.

Analysts at BlueCyber published a detailed report outlining the attack methodology, emphasizing the modular nature of the malware chain. Instead of relying on a single, easily detectable malicious file, the attackers engineered a series of interconnected components that only reveal their full functionality when executed in sequence. This layered approach significantly complicates detection by security tools that often analyze files in isolation.

Initial Infection and Dropper Mechanism

The attack initiates with two primary suspicious files: Browser_Update.zip and a seemingly innocuous image file named iis.jpg. Both have been identified as malicious across multiple vendor scans on VirusTotal. The initial dropper, Browser_Updater.exe, is carefully disguised as a legitimate browser update utility, complete with a convincing user interface mimicking Adobe Acrobat and digital signatures from a Chinese company to enhance its credibility.

Upon execution and user interaction (clicking “Install”), Browser_Updater.exe silently connects to a remote server. It then downloads what appears to be a JPEG image (iis.jpg) but is, in fact, a hidden MSI installer. This installer proceeds to drop three critical files onto the victim’s machine, marking the next stage of the infection.

DLL Sideloading and Payload Execution

The three files dropped are Avk.exe, Avk.dll, and AVKTray.dat. A key element of this deception is the use of Avk.exe, a legitimate and digitally signed binary from G DATA AntiVirus. This legitimate executable is exploited through DLL sideloading, a technique where the malicious Avk.dll is placed in a location where Avk.exe will load it instead of its legitimate counterpart. Leveraging a signed executable significantly reduces the likelihood of triggering security alerts.

Avk.dll acts as an intermediate loader, employing runtime hashing to resolve Windows APIs dynamically, thereby avoiding static analysis detection. It reads the encrypted payload contained within AVKTray.dat, grants it execute permissions in memory, and then triggers its execution via a Windows threadpool callback. This method further obscures the true origin of the malicious code, making it difficult for security monitoring tools to trace.

The payload within AVKTray.dat undergoes multiple decryption stages, including XOR and RC4 decryption using the key “VOphJo,” before being manually mapped directly into memory. This “fileless” execution minimizes disk footprints. After successful loading, the malware establishes persistence by installing itself into the %PUBLIC%GData directory and creating a new entry in the Windows Run registry key, ensuring it restarts with every user login.

Command-and-Control Communication and Capabilities

Once fully installed, the PlugX RAT connects to its command-and-control (C2) server at fruitbrat[.]com over port 443. The use of HTTPS for communication helps the traffic blend in with normal web activity. Furthermore, the malware crafts its network requests to mimic legitimate Microsoft Edge browser activity, making network-level detection even more challenging. To identify the compromised machine, a unique client ID is stored in the registry and transmitted to the C2 server.

The capabilities of the PlugX implant are extensive, granting attackers comprehensive control over the infected system. These capabilities include:

• Downloading and executing arbitrary files from the C2 server.
• Launching processes and capturing their output.
• Uploading and downloading file chunks, facilitating data exfiltration and further malware deployment.
• Enumerating and deleting files on the compromised system.
• Terminating diagnostic tools, such as iediagcmd.exe, to hinder detection by system administrators.

The presence of plugin loader stubs within the code indicates that the attackers can push additional modules and functionalities to infected machines as needed, allowing for adaptable and evolving post-compromise activities.

What You Should Do

• Enhance Endpoint Detection: Monitor for the simultaneous appearance of Avk.exe, Avk.dll, and AVKTray.dat in unusual directories like %PUBLIC%GData or %LOCALAPPDATA%pZhozR.
• Inspect Registry Run Keys: Look for suspicious entries in HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun that point to Avk.exe with trailing numeric arguments.
• Implement Network Monitoring: Scrutinize outbound HTTPS traffic to unusual domains, particularly fruitbrat[.]com (or its defanged variants) and dalerocks[.]com, especially when originating from non-browser processes.
• Behavioral Analysis: Prioritize security solutions capable of tracking the full execution chain of processes rather than relying solely on individual Indicators of Compromise (IoCs). This behavioral approach is crucial for detecting sophisticated, multi-stage attacks like those employed by Mustang Panda.
• User Awareness Training: Educate users about the dangers of fake software updates and the importance of verifying software legitimacy before installation.
• Maintain Up-to-Date Security: Ensure all operating systems, applications, and security software are regularly updated and patched to mitigate known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.