China-nexus Threat Actor Targets Persian Gulf Region With PlugX

On March 1, 2026, ThreatLabz observed new activity from a China-nexus threat actor targeting countries in the Persian Gulf region. The activity took place within the first 24 hours of the renewed conflict in the Middle East. The threat actor quickly weaponized the theme of the conflict, using an Arabic-language document lure depicting missile attacks for social engineering.

The campaign used a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. Based on the tools, techniques, and procedures (TTPs) observed, ThreatLabz attributes this activity to a China-nexus threat actor with high confidence, and assesses with medium confidence that it may be linked to Mustang Panda .

In this blog post, ThreatLabz examines the end-to-end attack chain in depth, including Windows shortcut (LNK) and CHM-based droppers, a loader with highly obfuscated shellcode, and a PlugX backdoor.

On March 1, 2026, ThreatLabz identified an attack chain themed around the ongoing Middle East conflict that delivered its payloads via a ZIP archive. The archive included a Windows shortcut (LNK) file that, when opened, downloaded a malicious Windows Compiled HTML Help (CHM) file from a threat actor-controlled server. The CHM content was then leveraged to deploy a multi-stage payload, progressing from a shellcode loader to heavily obfuscated shellcode, and ultimately to the installation of a PlugX backdoor variant. The attack chain is shown in the figure below.

Figure 1: Attack chain leading to deployment of PlugX.

As part of the lure, the attack dropped a decoy PDF containing images of missile strikes. The Arabic text in the PDF translates to “Iranian missile strikes against US base in Bahrain”. The figure below shows the decoy PDF file used in this attack.

Figure 2: PDF lure referencing Iranian missile strikes against a US base in Bahrain.

The following sections summarize the observed attack flow and the files involved.

The ZIP archive contains an LNK file named photo_2026-03-01_01-20-48.pdf.lnk . The LNK’s target command line uses cURL to download a malicious CHM file from hxxps:// The LNK file then uses the legitimate Windows HTML Help executable (hh.exe) with the -decompile option to extract the CHM contents. The below table summarizes the files extracted from the CHM.

Stage 2 Windows shortcut.

Decoy PDF used as a lure.

TAR archive containing malicious components.

Table 1: Files extracted from the CHM

The Stage 1 LNK launches the Stage 2 shortcut ( 0.lnk ).

The Stage 2 LNK performs the following actions:

The figure below shows the directory structure of the files extracted from the TAR archive.

Figure 3: Directory structure of the TAR archive.

, ShellFolder.exe uses DLL sideloading to load a malicious DLL named ShellFolderDepend.dll .

ShellFolderDepend.dll is a 32-bit DLL that establishes persistence, and then decrypts and executes an encrypted shellcode payload stored in Shelter.ex .

The shellcode loader stores its strings in encrypted form and decrypts them at runtime using a custom index-based XOR algorithm that incorporates an additive constant, as shown below.

To establish persistence, the DLL enumerates running processes to determine whether bdagent.exe (Bitdefender Agent) is present. Based on the result, the DLL uses one of two persistence methods:

Before decrypting and loading the shellcode, the shellcode loader installs two inline API hooks:

The DLL calls the Windows Native API SystemFunction033 (RC4) to decrypt shellcode stored in Shelter.ex (located alongside the DLL) using the key 20260301@@@ . The DLL then:

This stage is a 32-bit, position-independent shellcode that is heavily obfuscated with control flow flattening (CFF). The -stage backdoor is stored, encrypted, and compressed inside this shellcode, then decrypted and decompressed at runtime. The backdoor is loaded and executed to continue the stage of the attack.

The CFF technique used in the shellcode leverages a state machine, where a state variable determines the address of the execution block. Each basic block updates the state variable after execution and returns control to a dispatcher, which routes execution to the block. This is a simple yet effective implementation of CFF to make reverse engineering more time consuming.

All API names are stored encrypted in the shellcode and are decrypted at runtime using an index-based XOR decryption algorithm similar to the one used in the shellcode loader. The only change is the additive constant, which is 0x36 instead of 0x34.

In addition, the XOR operations are obfuscated using mixed boolean arithmetic (MBA), typically using the pattern (~x & K) | (x & ~K), which is equivalent to x ^ K.

The embedded payload is decrypted using the following steps:

The decryption algorithm can be represented as follows:

The decrypted blob begins with a 16-byte header followed by a payload compressed using LZNT1 algorithm. Below is the structure of the decrypted blob.

The loader uses the Windows API RtlDecompressBuffer to decompress the LZNT1 compressed payload.

The decompressed payload contains a corrupted MZ/PE header. The IMAGE_DOS_HEADER, DOS stub, and PE signature are corrupted with randomly generated ASCII data as an anti-forensics mechanism to evade memory forensics solutions. The figure below shows the corrupted MZ/PE headers.

Figure 4: Corrupted MZ/PE headers in the decrypted PlugX backdoor.

The table below summarizes which fields are corrupted in the header and which fields are left intact.

Expected structure and bytes

IMAGE_DOS_HEADER (4D 5A 90 00...)

Overwritten (60 bytes)

DOS Stub ("... This program cannot be run in DOS mode …")

Overwritten (56 bytes)

PE Signature (50 45 00 00)

Overwritten (4 bytes)

Table 2: Summary of the various fields in the corrupted PlugX MZ/PE headers.

The decrypted and decompressed payload is reflectively loaded by mapping all the sections to memory allocated using VirtualAlloc, performing relocations, resolving imports, and marking the memory region as executable. The first 0x20 bytes of the image base are repurposed and used as a context structure that is passed to DllMain of the reflectively loaded DLL. The PlugX encrypted configuration is present inside the shellcode and a pointer to it is stored at offset 0x14 in the context structure. The structure is defined as follows:

In this instance, the PlugX image headers serve a dual purpose. They are overwritten with junk data to evade memory forensics, and they are also reused as a context structure passed to the reflectively loaded DLL for PlugX configuration decryption.

The PlugX backdoor reflectively loaded by the shellcode is also similarly obfuscated with CFF and MBA. API strings are also encrypted using an algorithm similar to the one observed in the shellcode loader and the shellcode.

After receiving the encrypted PlugX configuration details via the context structure passed to DllMain by the shellcode, the configuration is decrypted in two stages.

First, the entire encrypted blob is decrypted using a custom algorithm (implemented in Python below):

Stage 2 (PlugX configuration decryption)

The individual fields within the decrypted configuration are further decrypted using RC4 with the key qwedfgx202211 . The table below summarizes the decrypted configuration used for this PlugX sample.

*.doc*|*.pdf|*.xls*|*.ppt*|*.mp3|*.wav

%ProgramFiles%\Microsoft\Display Broker

Microsoft Desktop Dialog Broker

Manages the connection and configuration of local and remote displays dialog.

Table 3: The decrypted configuration used for this PlugX sample.

This PlugX sample supports the following C2 channels:

This PlugX sample supports the following C2 commands. These are largely similar to prior PlugX analysis, and a detailed description is available here .

Collect and send system information.

Request another command.

Update configuration.

Information processes with injections (userinit.exe).

Get results of LAN scanning.

Proxy to other PlugX instances.

Table 4: C2 commands supported by this sample of PlugX.

This sample uses the following plugins:

Table 5: Plugins used by this sample of PlugX.

ThreatLabz attributes this attack to a China-nexus threat actor with high confidence, and we assess with medium confidence that this activity could be linked to Mustang Panda based on the following factors.

This campaign, attributed to a China-nexus threat actor, targeted countries in the Persian Gulf region using a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. Our analysis underscores how China-nexus actors, including Mustang Panda, rapidly weaponize geopolitical events, such as the ongoing Middle East conflict, to craft timely social engineering lures.

ThreatLabz urges the security community to exercise caution when opening unsolicited files or clicking links that claim to provide news or updates related to the Middle East conflict.

Zscaler’s multilayered cloud security platform detects indicators related to the targeted attacks mentioned in this blog at various levels with the following threat names:

20eb9f216a1177ee539a012e6301a93e

43c36b06573aeadabb55fd46c55a68c41a16ecc7

733a0a0ead4fc38173d7e30c7f2e14442ede32507e8adcbb8d3bd719fd2079d0

photo_2026-03-01_01-20-48.zip

ZIP archive containing the LNK

Eb27bbc29b36ae9c66970654925d8c3b

E3dc5ef72a9d08790f2f21726fa270b77dea3803

fa3a1153018ac1e1a35a65e445a2bad33eac582c225cf6c38d0886802481cd43

photo_2026-03-01_01-20-48.pdf.lnk

Stage 1 malicious Windows shortcut LNK file

B92e4615bb8026a593f0a72451285140

E15c3ff555a30dff5b66333492eed43e07ec72a1

10df3c46624c416f44764d7903b8079bc797c967284afc5bc333eeba0fdbba18

Stage 2 malicious Windows shortcut LNK file

Da91acba97f7d2935149d80142df8ec9

Ec955e2b6874159c63578d6bb85fe67117d45508

e50a4069e173256498e9e801b8f0dcda5a217290869300055ad8a854d4ea210c

Decoy PDF file used as a social engineering lure

A158f22a6bf5e3678a499c3a2b039b16

A5e42ac01e59d61c582e696edfde76452e35a43c

5adae26409c6576f95270ce9ca3877df3ee60849c18540fd92c0c9c974ba2f6d

4f6ea828ab0456539cf7d79af90acf87

31817d5baa9cc6ff22c172652ef312b7300c18a2

c78eb1cecef5f865b6d150adcf67fa5712c5a16b94f1618c32191e61fbe69590

ShellFolderDepend.dll

Bf298f5b0ea62640f538922b32b8c3ed

2d70a3f331278b490361d3f7274082f69184209d

1ddbed0328a60bb4f725b4ef798d5d14f29c04f7ffe9a7a6940cacb557119a1c

93a98995ebfd672793b3413606211fa3

537044b0c8930522aa1bbbf6220077b36abcdf54

014192c07267294116115d867b1dd48d851f0fa4c011cd96e4c5a5f81a6d1de3

43622a9b16021a5fb053e89ea5cb2c4c

Bdf4b77508c9295a2e70736ee6d689722f67802e

ef7a813124fd19d11bb5d944cb95779f5fe09ff5a18c26399002759d4b0d66e7

Decrypted and decompressed PlugX backdoor

URL hosting the CHM file

hxxps[:]//

Develop Capabilities: Malware

The threat actor developed custom PlugX loaders.

Resource Development: Obtain Capabilities, Malware

The threat actor used the PlugX backdoor, a known backdoor commonly used by China-nexus threat actors.

Resource Development: Stage Capabilities: Upload Malware

The threat actor staged a malicious CHM file on a threat actor-controlled server.

Initial Access: Phishing

The threat actor phished users in the GCC region with an archive containing a lure referencing Iranian missile strikes against a US base in Bahrain.

Execution: User Execution: Malicious File

The attack chain is initiated when a victim opens a malicious LNK file named photo_2026-03-01_01-20-48.pdf.lnk which was delivered inside a ZIP archive.

Execution: Command and Scripting Interpreter: Windows Command Shell

The initial LNK file's target command-line uses cURL to download a malicious CHM file and to extract its contents.

Execution: Native API

ShellFolderDepend.dll calls VirtualAlloc for shellcode and SystemFunction033 for RC4 decryption. PlugX uses RtlDecompressBuffer for payload decompression.

Persistence: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

ShellFolderDepend.dll adds a Run key (BaiNetdisk) using reg.exe or RegSetValueExA to point to the malicious ShellFolder.exe.

Persistence: Create or Modify System Process: Windows Service

The PlugX backdoor payload is configured to operate as a Windows service ("Microsoft Desktop Dialog Broker").

Privilege Escalation: Abuse Elevation Control Mechanism: Bypass User Account Control

PlugX contains code to abuse the Fodhelper UAC bypass technique to gain elevated privileges.

Defense Evasion: Masquerading: Double File Extension

The shortcut file was named photo_2026-03-01_01-20-48.pdf.lnk to appear as a benign PDF.

Defense Evasion: Masquerading: Match Legitimate Resource Name or Location

The malicious LNK extracts components into %AppData%\BaiduNetdisk\ to mimic a legitimate cloud storage application.

Defense Evasion: Deobfuscate/Decode Files or Information

Decrypts shellcode using RC4, decrypts API names via XOR, decompresses payloads using LZNT1, and decrypts configurations in multiple stages.

Defense Evasion: Masquerading: Masquerade Task or Service

PlugX uses service names like "Microsoft Desktop Dialog Broker" to mimic legitimate Microsoft services.

Defense Evasion: System Binary Proxy Execution: Compiled HTML File

The hh.exe file was used to conceal malicious components.

Defense Evasion: Reflective Code Loading

Loads the PlugX DLL directly into memory without writing it to disk.

Defense Evasion: Hijack Execution Flow: DLL

Uses DLL sideloading to load ShellFolderDepend.dll via ShellFolder.exe.

Defense Evasion: Obfuscated Files or Information

The malware used in this attack utilized various code obfuscation techniques like CFF and MBA.

Defense Evasion: Obfuscated Files or Information: Software Packing

The shellcode acts as a packer, decrypting and decompressing the final backdoor at runtime.

Defense Evasion: Obfuscated Files or Information: Dynamic API Resolution

The malware used in this attack stores API names in encrypted format and resolves imports dynamically at runtime.

Defense Evasion: Obfuscated Files or Information: Embedded Payloads

The final backdoor is embedded in shellcode. The CHM file contains an embedded TAR archive with malicious components.

Defense Evasion: Obfuscated Files or Information: Encrypted/Encoded File

The malwares used in this attack utilized RC4 and custom PRNG algorithms to encrypt files, shellcode, and configurations.

Defense Evasion: Obfuscated Files or Information: Compression

The loader uses LZNT1 compression for the -stage payload.

Defense Evasion: Obfuscated Files or Information: Junk Code Insertion

The malware used MBA, inserting useless junk operations to obscure program logic.

Discovery: System Information Discovery

PlugX supports a System Fingerprint command to gather operating system and hardware details.

Discovery: Software Discovery: Security Software Discovery

Specifically checks for the presence of Bitdefender Agent (bdagent.exe).

Discovery: File and Directory Discovery

Searches for specific extensions (*.doc*, *.pdf*, etc.) and uses a Disk plugin.

Command and Control: Application Layer Protocol: Web Protocols

PlugX establishes C2 communication via HTTPS on port 443.

Command and Control: Protocol Tunneling

PlugX has the capability to use DNS-over-HTTPS (DOH) using dns.google.

Command and Control: Proxy: Internal Proxy

PlugX has the capability to relay C2 traffic between PlugX instances (Command ID 10).

Command and Control: Encrypted Channel: Symmetric Cryptography

PlugX uses RC4 with a static key (VD*1^N1OCLtAGM$U) to encrypt C2 traffic.

Command and Control: Encrypted Channel: Asymmetric Cryptography

Various components in the attack chain use SSL/TLS within HTTPS for secure key exchange.

Command and Control: Non-Application Layer Protocol

PlugX supports TCP and UDP for C2 communications.

Command and Control: Ingress Tool Transfer

The LNK file uses cURL to download a malicious CHM file from a remote URL.

Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.