Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims

Keypoints

• Mustang Panda (aka HoneyMyte, Bronze President) is the China-based APT behind the campaign targeting Myanmar using PlugX.
• Initial infection stems from phishing emails with attachments designed to mimic local country/organization contexts, leveraging legitimate HP-related utilities in RAR archives.
• The attackers use a DLL loader in conjunction with a malicious DLL and a PlugX payload, employing DLL side-loading and DLL search order hijacking.
• The C2 infrastructure includes domains and sub-domains that impersonate Myanmar outlets (e.g., Images.myanmarnewsonline.org, Update.hilifimyanmar.com) and associated IPs (154.204.26.120, 45.134.83.4).
• PlugX is deployed via a heavily obfuscated loader that decrypts and loads the implant in memory, with dynamic API resolution and decompression steps involved.
• Defensive notes include a Mustang Panda–targeted YARA rule to detect the DLL artifact and observed MITRE ATT&CK techniques such as domain infrastructure use, obfuscation, and DLL side-loading.
• IoCs include specific file hashes and domain/IP indicators linked to the operation (e.g., Service Log.rar, HP.rar, and related C2 domains).