Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware

Cybersecurity: Mustang Panda's Advanced Cyber Espionage Techniques

A recent analysis by IBM's X-Force has identified an advanced cyber espionage campaign by the China-linked threat actor, Mustang Panda. This operation, first detected in June 2025, employs sophisticated DLL side-loading techniques targeting the Tibetan community.

The attack initiates with a specially crafted ZIP file containing an executable named 'Voice for the Voiceless Photos.exe.' This file references the Dalai Lama's book to appeal to the targeted audience. However, the archive conceals a malicious DLL file named libjyy.dll , hidden using Windows file attributes.

The DLL uses the following attributes for stealth:

a (Archive): Marks the file for backup. r (Read-only): Prevents modification. h (Hidden): Conceals the file from Windows Explorer. s (System File): Obscures the file even when "Show hidden files" is enabled.

This concealment technique ensures the DLL remains undetected unless specific settings are changed in Folder Options.

Analysis of the primary executable reveals signatures associated with China-nexus threat operations. The binary contains fabricated company information, such as "Hefei Nora Network Technology Co., Ltd." and "FFWallpaper Widgets Jyy." This loader dynamically loads the hidden DLL using the LoadLibraryW API.

The libjyy.dll functions as a multi-stage malware, known as Claimloader, implementing capabilities like string decryption, argument verification, and payload deployment.

The malware establishes persistence by copying the executable and DLL to a fabricated Adobe directory and creating registry entries under Software\Microsoft\Windows\CurrentVersion\Run . Additionally, it utilizes Windows Task Scheduler to create a scheduled task named "AdobeExperienceManager," running every two minutes:

schtasks /F /Create /TN "AdobeExperienceManager" /SC minute /MO 2 /TR "C:\ProgramData\AdobeLicensingPlugin\WF_Adobe_licensing_helper.exe Licensing"

This dual persistence complicates incident response efforts, maintaining access even if one method is removed.

When executed with the correct argument, the Claimloader allocates memory using VirtualAlloc and deploys shellcode, using EnumFontsW API for execution. The shellcode, known as Publoader, employs API hashing with the ROR13 algorithm for Windows API resolution.

Publoader performs Process Environment Block (PEB) walking to load required modules, facilitating communication with command-and-control infrastructure for data exfiltration.

This campaign illustrates Mustang Panda's evolving targeting methodologies, combining social engineering with technical obfuscation. Security teams should monitor for unusual DLL loading, scheduled task creation, and registry modifications to detect similar threats effectively.

Based on reporting by GBHackers.