Recent reporting from multiple security teams shows Mustang Panda continuing to use archive-based lures, malicious Windows shortcut files, and script-driven loaders to deliver PlugX, a remote access trojan long associated with the group’s espionage activity.
The campaign stands out because it turns a simple user action opening what appears to be a document or PDF into a layered infection chain in which a disguised LNK file launches PowerShell or related script components, opens a decoy file for the victim, and quietly starts malware in the background.
PlugX remains one of Mustang Panda’s best-known tools for covert surveillance and long-term access, and recent analysis suggests the actor keeps reusing the same broad tradecraft while changing lures, staging methods, and command-and-control details across operations.
Mustang Panda Delivers PlugX
Anomali reported that Mustang Panda often hides a .lnk file inside a ZIP archive and uses double extensions. Hence, the file appears to be a normal document.
At the same time, the shortcut can contain embedded HTA content with VBScript or PowerShell that drops payloads and displays a decoy PDF or document to reduce suspicion.
CrowdStrike described a similar sequence in which a victim is led from a shared or shortened link to a ZIP file, opens a fake document shortcut, and is then redirected to attacker-controlled content that retrieves both a decoy file and a PowerShell script, showing how the group blends social engineering with trusted Windows features instead of relying on a single exploit.
Dream Group said later stages of the attack chain use PowerShell-based extraction of an embedded payload, followed by DLL search-order hijacking and in-memory execution of a reduced PlugX payload.
In contrast, SOC Prime said analysts rebuilt the full path from LNK activation to PowerShell staging, encrypted DLL handling, reflective loading, thread-pool injection, and final PlugX runtime.
Earlier reporting from EclecticIQ and Anvilogic shows the same pattern has appeared in different wrappers, including ISO images or archive files carrying LNKs disguised as PDFs or documents, with PowerShell, mshta, and side-loading used to fetch or launch the final malware.
According to Hashnode research, but the number of stealth layers wrapped around it, because researchers observed API hashing, PEB walking, heavy string obfuscation, reflective loading, and memory-based execution tricks that make the intrusion much harder to detect with simple signature checks or file-based scanning alone.
Dream Group also found that several samples shared the same structured reduced PlugX configuration except for the command-and-control address, suggesting the operator is using a stable malware framework that can be quickly repackaged for new political or diplomatic lures without rewriting the full toolset.
The broader targeting picture also fits long-running espionage behavior, with Dream Group linking one campaign to diplomatic, election, and policy officials and older reporting showing Mustang Panda repeatedly adapting the same LNK-led delivery method across regional and politically themed operations.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
