Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025

CANONSTAGER has utilized custom API hashing to obfuscate the Windows APIs being used.

Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload. Mustang Panda has also masqueraded legitimate browser plugin updates to include AdobePlugins.exe.

STATICPLUGIN has leveraged naming conventions that match legitimate services to include AdobePlugins.exe.

CANONSTAGER has leveraged naming conventions of its malicious DLL to match legitimate services to include cnmpaui.dll which matches the legitimate executable cnmpaui.exe that is aligned with a Canon Ink Jet Printer Assistant Tool.

STATICPLUGIN has masqueraded as a BMP file to hide its true MSI file extension.

CANONSTAGER uses the Thread Local Storage (TLS) array data structure to store function addresses resolved by its custom API hashing algorithm. The function addresses are later called throughout the binary from offsets into the TLS array.

PlugX allows actors to spawn a reverse shell on a victim.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

PlugX has a module to download and execute files on the compromised machine.

CANONSTAGER has leveraged Native API calls to execute code within the victim’s system including `GetCurrentDirectoryW`, `RegisterClassW` and `CreateWindowExW`. CANONSTAGER also created a new overlapped window that initiates callback functions to a windows procedure that processes Windows messages until a designated message type of 0x0018 WM_SHOWWINDOW is observed which then initiates the deployment of a subsequent malicious payload.

Mustang Panda has used various Windows API calls during execution and defense evasion.

Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder. Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.

STATICPLUGIN has required user execution to load subsequent malicious payloads.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

STATICPLUGIN has been signed with a valid Certificate Authority(CA) to circumvent endpoint defenses.

Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.

STATICPLUGIN has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.

CANONSTAGER has created a new window with a height and width of zero to remain hidden on the screen.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

CANONSTAGER has abused legitimate executables to side-load malicious DLLs.

Mustang Panda has acquired C2 domains prior to operations.

Mustang Panda has obtained SSL certificates for their C2 domains.

PlugX has loaded its payload into memory.