Mustang Panda deploys a new wave of malware targeting Europe
Summary: Cisco Talos reports that Mustang Panda, a China-based threat actor active since at least 2012, shifted its phishing lures in early 2022 to European and Russian themes, including a fake European Commission report on state aid to Greece, an EU human rights press release, and documents tied to Russia's invasion of Ukraine. The lures deliver PlugX remote access trojan implants through downloader executables and archive files containing a benign executable, a DLL loader, and an encrypted payload, with later campaigns using only two remote URLs to fetch the full infection chain.
What you should know: The group has targeted government organizations, think tanks, NGOs, and telecom firms across the US, Europe, and Asia since at least 2012, and its lures now track live geopolitical events closely enough that a document about the Ukraine border situation or a Frontex invitation can be the infection vector.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026