ThreatLabz Attributes PlugX Campaign Targeting Arabian Gulf to China-Nexus Actor
Summary
ThreatLabz reports a March 2026 campaign targeting Arabian Gulf countries with an Arabic conflict-themed lure and a multi-stage chain deploying PlugX. It attributes the activity to a China-nexus actor and says a Mustang Panda link is possible.
Key points
- ThreatLabz observed the activity on March 1, 2026, and attributed it with high confidence to a China-nexus actor; it assessed a possible link to Mustang Panda with medium confidence.
- The lure used an Arabic-language PDF depicting missile strikes. A ZIP archive delivered an LNK that downloaded a CHM file, which led to further shortcuts and payloads.
- A loader used DLL sideloading, established Run-key persistence, and decrypted and executed shellcode. Its persistence method depended on whether the Bitdefender Agent process was running.
- The shellcode and PlugX backdoor used control-flow flattening and mixed boolean arithmetic to hinder analysis. The backdoor was reflectively loaded, and its PE headers were overwritten with junk data as an anti-forensics measure.
- The PlugX configuration supported TCP, HTTPS, UDP, and DNS-over-HTTPS for domain resolution. Its listed commands included collecting system information, triggering plugins, LAN scanning, and proxying to other PlugX instances.
- ThreatLabz advised caution with unsolicited files or links presented as Middle East conflict news or updates.
Article Details
- Attack Vectors
- An Arabic-language document lure referencing missile strikes was delivered in a ZIP archive containing a Windows shortcut (LNK).
- The LNK used cURL to download a CHM file from a threat actor-controlled server; the CHM led to a second LNK and a TAR archive extracted into %AppData%.
- ShellFolder.exe loaded ShellFolderDepend.dll through DLL sideloading. The DLL established persistence, decrypted shellcode, and ultimately loaded a PlugX backdoor.
- The PlugX sample supports TCP, HTTPS, and DNS-over-HTTPS for command-and-control and domain resolution.
- Defensive Notes
- ThreatLabz advises caution when opening unsolicited files or clicking links claiming to provide news or updates related to the Middle East conflict.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]193[.]17[.]117 | C2 IP address listed for the PlugX sample. |
| MD5 | 20eb9f216a1177ee539a012e6301a93e | MD5 hash of the malicious ZIP archive containing the LNK. |
| MD5 | 43622a9b16021a5fb053e89ea5cb2c4c | MD5 hash of the decrypted and decompressed PlugX backdoor. |
| MD5 | 4f6ea828ab0456539cf7d79af90acf87 | MD5 hash of ShellFolderDepend.dll, the shellcode loader. |
| MD5 | 93a98995ebfd672793b3413606211fa3 | MD5 hash of the decrypted shellcode. |
| MD5 | a158f22a6bf5e3678a499c3a2b039b16 | MD5 hash of the TAR archive containing malicious components. |
| MD5 | b92e4615bb8026a593f0a72451285140 | MD5 hash of the malicious Stage 2 Windows shortcut. |
| MD5 | bf298f5b0ea62640f538922b32b8c3ed | MD5 hash of Shelter.ex, the encrypted shellcode payload. |
| MD5 | da91acba97f7d2935149d80142df8ec9 | MD5 hash of the decoy PDF used as a social engineering lure. |
| MD5 | eb27bbc29b36ae9c66970654925d8c3b | MD5 hash of the malicious Stage 1 Windows shortcut. |
| SHA1 | 2d70a3f331278b490361d3f7274082f69184209d | SHA-1 hash of Shelter.ex, the encrypted shellcode payload. |
| SHA1 | 31817d5baa9cc6ff22c172652ef312b7300c18a2 | SHA-1 hash of ShellFolderDepend.dll, the shellcode loader. |
| SHA1 | 43c36b06573aeadabb55fd46c55a68c41a16ecc7 | SHA-1 hash of the malicious ZIP archive containing the LNK. |
| SHA1 | 537044b0c8930522aa1bbbf6220077b36abcdf54 | SHA-1 hash of the decrypted shellcode. |
| SHA1 | a5e42ac01e59d61c582e696edfde76452e35a43c | SHA-1 hash of the TAR archive containing malicious components. |
| SHA1 | bdf4b77508c9295a2e70736ee6d689722f67802e | SHA-1 hash of the decrypted and decompressed PlugX backdoor. |
| SHA1 | e15c3ff555a30dff5b66333492eed43e07ec72a1 | SHA-1 hash of the malicious Stage 2 Windows shortcut. |
| SHA1 | e3dc5ef72a9d08790f2f21726fa270b77dea3803 | SHA-1 hash of the malicious Stage 1 Windows shortcut. |
| SHA1 | ec955e2b6874159c63578d6bb85fe67117d45508 | SHA-1 hash of the decoy PDF used as a social engineering lure. |
| SHA256 | 014192c07267294116115d867b1dd48d851f0fa4c011cd96e4c5a5f81a6d1de3 | SHA-256 hash of the decrypted shellcode. |
| SHA256 | 10df3c46624c416f44764d7903b8079bc797c967284afc5bc333eeba0fdbba18 | SHA-256 hash of the malicious Stage 2 Windows shortcut. |
| SHA256 | 1ddbed0328a60bb4f725b4ef798d5d14f29c04f7ffe9a7a6940cacb557119a1c | SHA-256 hash of Shelter.ex, the encrypted shellcode payload. |
| SHA256 | 5adae26409c6576f95270ce9ca3877df3ee60849c18540fd92c0c9c974ba2f6d | SHA-256 hash of the TAR archive containing malicious components. |
| SHA256 | 733a0a0ead4fc38173d7e30c7f2e14442ede32507e8adcbb8d3bd719fd2079d0 | SHA-256 hash of the malicious ZIP archive containing the LNK. |
| SHA256 | c78eb1cecef5f865b6d150adcf67fa5712c5a16b94f1618c32191e61fbe69590 | SHA-256 hash of ShellFolderDepend.dll, the shellcode loader. |
| SHA256 | e50a4069e173256498e9e801b8f0dcda5a217290869300055ad8a854d4ea210c | SHA-256 hash of the decoy PDF used as a social engineering lure. |
| SHA256 | ef7a813124fd19d11bb5d944cb95779f5fe09ff5a18c26399002759d4b0d66e7 | SHA-256 hash of the decrypted and decompressed PlugX backdoor. |
| SHA256 | fa3a1153018ac1e1a35a65e445a2bad33eac582c225cf6c38d0886802481cd43 | SHA-256 hash of the malicious Stage 1 Windows shortcut. |
| URL | hxxps[:]//91[.]193[.]17[.]117 | PlugX configuration identifies this as the campaign's C2 endpoint. |
| URL | hxxps[:]//www[.]360printsol[.]com/2026/alfadhalah/thumbnail?img=index.png | Threat actor-controlled URL used by the LNK to download the malicious CHM file. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe shellcode and PlugX backdoor used control flow flattening, mixed boolean arithmetic, encrypted strings, and encrypted payloads to hinder analysis.T1057 · Process DiscoveryThe DLL enumerated running processes to check whether bdagent.exe was present before choosing its persistence method.T1071.001 · Web ProtocolsThe PlugX sample supports HTTPS for command-and-control communication.T1071.004 · DNSThe PlugX sample supports DNS-over-HTTPS for domain resolution.T1082 · System Information DiscoveryA supported PlugX command collects and sends system information.T1090 · ProxyA supported PlugX command proxies traffic to other PlugX instances.T1105 · Ingress Tool TransferThe LNK used cURL to download a malicious CHM file from the threat actor-controlled server.T1204.002 · Malicious FileThe campaign used an LNK inside a ZIP archive, opened by the recipient, to start the attack chain.T1218.001 · Compiled HTML FileThe LNK used the legitimate hh.exe HTML Help executable with the -decompile option to extract CHM contents.T1547.001 · Registry Run Keys / Startup FolderThe loader established persistence by setting a user Run registry entry to launch ShellFolder.exe at login.T1574.002 · DLL Side-LoadingShellFolder.exe loaded the malicious ShellFolderDepend.dll through DLL sideloading.T1620 · Reflective Code LoadingThe loader decrypted shellcode and executed it from memory; the shellcode reflectively loaded the PlugX DLL.