China-Nexus Actor Targets Arabian Gulf with Obfuscated PlugX Campaign
Summary
ThreatLabz details a March 2026 campaign targeting Arabian Gulf countries with Arabic conflict-themed lures and a multi-stage chain that installs PlugX, featuring DLL sideloading, obfuscated shellcode, persistence, and HTTPS and DNS-over-HTTPS command-and-control.
Key points
- ThreatLabz observed the activity on March 1, 2026, and attributes it with high confidence to a China-nexus actor; a link to Mustang Panda is assessed with medium confidence.
- A ZIP archive delivered an LNK shortcut that downloaded a CHM file; subsequent stages used another LNK and a TAR archive to install the payload.
- An Arabic-language decoy PDF depicting missile strikes was used as a social-engineering lure.
- A DLL sideloaded by ShellFolder.exe established persistence through a Run registry entry and decrypted shellcode for execution.
- The shellcode reflectively loaded a PlugX variant whose obfuscation included control-flow flattening, mixed boolean arithmetic, and corrupted PE headers.
- The PlugX sample supports TCP, HTTPS, UDP, and DNS-over-HTTPS for domain resolution, and includes plugins for functions such as file, process, service, screen, and keylogging operations.
- The article provides file hashes and network indicators, including a malicious CHM URL and a C2 IP address.
Article Details
- Attack Vectors
- A ZIP archive delivered an LNK file that downloaded a malicious CHM file from attacker-controlled infrastructure.
- The CHM extracted a second LNK, a decoy PDF, and a TAR archive containing the components used to install a PlugX backdoor.
- The attack used an Arabic-language conflict-themed PDF lure depicting missile strikes for social engineering.
- ShellFolder.exe loaded ShellFolderDepend.dll through DLL sideloading; the DLL decrypted and executed shellcode that reflectively loaded PlugX.
- Defensive Notes
- Exercise caution with unsolicited files or links claiming to provide news or updates related to the Middle East conflict.
- The loader established persistence through a Run registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- The PlugX sample supports TCP, HTTPS, UDP, and DNS-over-HTTPS for domain resolution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]193[.]17[.]117 | C2 IP address listed in the PlugX configuration. |
| MD5 | 20eb9f216a1177ee539a012e6301a93e | Hash of the malicious ZIP archive containing the LNK. |
| MD5 | 43622a9b16021a5fb053e89ea5cb2c4c | Hash of the decrypted and decompressed PlugX backdoor. |
| MD5 | 4f6ea828ab0456539cf7d79af90acf87 | Hash of ShellFolderDepend.dll, the shellcode loader. |
| MD5 | 93a98995ebfd672793b3413606211fa3 | Hash of the decrypted shellcode. |
| MD5 | a158f22a6bf5e3678a499c3a2b039b16 | Hash of the TAR archive containing malicious components. |
| MD5 | b92e4615bb8026a593f0a72451285140 | Hash of the malicious Stage 2 LNK file. |
| MD5 | bf298f5b0ea62640f538922b32b8c3ed | Hash of Shelter.ex, the encrypted shellcode artifact. |
| MD5 | da91acba97f7d2935149d80142df8ec9 | Hash of the decoy PDF used as a social-engineering lure. |
| MD5 | eb27bbc29b36ae9c66970654925d8c3b | Hash of the malicious Stage 1 LNK file. |
| SHA1 | 2d70a3f331278b490361d3f7274082f69184209d | Hash of Shelter.ex, the encrypted shellcode artifact. |
| SHA1 | 31817d5baa9cc6ff22c172652ef312b7300c18a2 | Hash of ShellFolderDepend.dll, the shellcode loader. |
| SHA1 | 43c36b06573aeadabb55fd46c55a68c41a16ecc7 | Hash of the malicious ZIP archive containing the LNK. |
| SHA1 | 537044b0c8930522aa1bbbf6220077b36abcdf54 | Hash of the decrypted shellcode. |
| SHA1 | a5e42ac01e59d61c582e696edfde76452e35a43c | Hash of the TAR archive containing malicious components. |
| SHA1 | bdf4b77508c9295a2e70736ee6d689722f67802e | Hash of the decrypted and decompressed PlugX backdoor. |
| SHA1 | e15c3ff555a30dff5b66333492eed43e07ec72a1 | Hash of the malicious Stage 2 LNK file. |
| SHA1 | e3dc5ef72a9d08790f2f21726fa270b77dea3803 | Hash of the malicious Stage 1 LNK file. |
| SHA1 | ec955e2b6874159c63578d6bb85fe67117d45508 | Hash of the decoy PDF used as a social-engineering lure. |
| SHA256 | 014192c07267294116115d867b1dd48d851f0fa4c011cd96e4c5a5f81a6d1de3 | Hash of the decrypted shellcode. |
| SHA256 | 10df3c46624c416f44764d7903b8079bc797c967284afc5bc333eeba0fdbba18 | Hash of the malicious Stage 2 LNK file. |
| SHA256 | 1ddbed0328a60bb4f725b4ef798d5d14f29c04f7ffe9a7a6940cacb557119a1c | Hash of Shelter.ex, the encrypted shellcode artifact. |
| SHA256 | 5adae26409c6576f95270ce9ca3877df3ee60849c18540fd92c0c9c974ba2f6d | Hash of the TAR archive containing malicious components. |
| SHA256 | 733a0a0ead4fc38173d7e30c7f2e14442ede32507e8adcbb8d3bd719fd2079d0 | Hash of the malicious ZIP archive containing the LNK. |
| SHA256 | c78eb1cecef5f865b6d150adcf67fa5712c5a16b94f1618c32191e61fbe69590 | Hash of ShellFolderDepend.dll, the shellcode loader. |
| SHA256 | e50a4069e173256498e9e801b8f0dcda5a217290869300055ad8a854d4ea210c | Hash of the decoy PDF used as a social-engineering lure. |
| SHA256 | ef7a813124fd19d11bb5d944cb95779f5fe09ff5a18c26399002759d4b0d66e7 | Hash of the decrypted and decompressed PlugX backdoor. |
| SHA256 | fa3a1153018ac1e1a35a65e445a2bad33eac582c225cf6c38d0886802481cd43 | Hash of the malicious Stage 1 LNK file. |
| URL | hxxps[:]//www[.]360printsol[.]com/2026/alfadhalah/thumbnail?img=index[.]png | Attacker-controlled URL used by the LNK to download the malicious CHM file. |
MITRE ATT&CK
T1071.001 · Web ProtocolsThe PlugX sample supports HTTPS command-and-control communication.T1204.002 · Malicious FileThe attack chain relied on opening a malicious Windows shortcut (LNK) from the delivered archive.T1218.001 · Compiled HTML FileThe LNK used the legitimate Windows HTML Help executable hh.exe with the -decompile option to extract CHM contents.T1547.001 · Registry Run Keys / Startup FolderThe loader established persistence using a Run registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.T1574.002 · DLL Side-LoadingShellFolder.exe sideloaded the malicious ShellFolderDepend.dll.T1620 · Reflective Code LoadingThe shellcode reflectively loaded the PlugX DLL by mapping its sections into allocated memory, resolving imports, and executing it.
Threat Actors
Malware
Vendors
Products
Bitdefender Agentreturn "".join(decrypted)To establish persistence, the DLL enumerates running processes to determine whether bdagent.exe (Bitdefender Agent) is present. Based on the result, the DLL uses one of two persistence methods:Microsoft WindowsIn this blog post, ThreatLabz examines the end-to-end attack chain in depth, including Windows shortcut (LNK) and CHM-based droppers, a loader with highly obfuscated shellcode, and a PlugX backdoor.