Mustang Panda Using New DLL Side-Loading Technique to Deliver Malware
Recently, cybersecurity analysts have identified the Mustang Panda threat actor employing a new DLL side-loading technique to deliver malicious payloads.
Recently, cybersecurity analysts have identified the Mustang Panda threat actor employing a new DLL side-loading technique to deliver malicious payloads.
This campaign, which began in June 2025, utilizes politically-themed lures aimed at Tibetan advocacy groups.
The attack involves a ZIP archive containing a decoy executable named Voice for the Voiceless Photos.exe along with a hidden dynamic-link library, libjyy.dll , which is marked with system and hidden attributes to avoid detection.
When executed, the decoy loads the hidden library via LoadLibraryW , activating the malware routine disguised as legitimate software.
The attack chain initiates with a phishing email containing the ZIP file. Once opened, the malicious DLL is concealed by its "hidden" and "system" flags.
The decoy executable dynamically loads libjyy.dll by resolving the ProcessMain entry point.
This loader employs dynamic API resolution and string decryption routines, complicating static detection.
After initialization, the malicious DLL decrypts its core payloads, establishes persistence through registry run keys and scheduled tasks, and extracts shellcode for execution.
Recently, cybersecurity analysts have identified the Mustang Panda threat actor employing a new DLL side-loading technique to deliver malicious payloads.
Persistence is achieved by renaming the decoy and loader to %SystemRoot%\Adobe\licensinghelper.exe and registering a run key named AdobeLicensingHelper under HKCU\Software\Microsoft\Windows\CurrentVersion\Run .
A scheduled task is then created to execute every two minutes, relaunching the loader with the required Licensing argument.
Mustang Panda's infection mechanism relies on the DLL side-loading technique T1574.006, known as "ClaimLoader."
The loader executable minimizes import references by decrypting API names at runtime.
An XOR routine with key 0x19 decodes encrypted strings before invoking LoadLibraryW and GetProcAddress .
mov edx, <encrypted_length> mov ecx, <encrypted_string_address> ; XOR decryption loop decrypt_loop: mov al, [ecx] xor al, 0x19 mov [ecx], al inc ecx dec edx jnz decrypt_loop ; After decryption, load API dynamically push <decrypted_string_address> call decryptstrloadapi call eax ; resolved API call
This code demonstrates how the loader avoids static imports, hiding its intentions until execution.
Once the real payload library is loaded, a secondary custom XOR algorithm—cycling through a key array [0x01, 0x02, 0x03, 0x04] —decrypts a command string in memory.
The decoded command schedules the loader to run periodically:
schtasks /Create /TN AdobeExperienceManager /SC MINUTE /MO 2 /TR "C:\Windows\Adobe\licensinghelper.exe Licensing" /F
The loader allocates executable memory via VirtualAlloc , copies shellcode, and uses the EnumFontsW callback to execute it.
The shellcode performs API hashing to resolve network functions and exfiltrate system data to a command-and-control server.
Mustang Panda uses these techniques to remain elusive, blending Windows APIs with dynamic loading and obfuscation to bypass traditional endpoint defenses.
Based on reporting by Cyber Security News.