Mustang Panda Uses LNK, PowerShell Chain to Deploy PlugX RAT

Gbhackers •Mayura Kathir • June 2, 2026

Mustang Panda is using a fake “Browser Updater” and a multi‑stage LNK–PowerShell loader to sideload PlugX through a legitimate G DATA antivirus binary, ultimately beaconing over HTTPS to a hard‑coded C2 while hiding configuration and strings behind layered encryption and API hashing. Mustang Panda is a China‑nexus APT group, long associated with PlugX remote access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Launches PlugX RAT Campaign via Fake Browser Update Mustang Panda, a Chinese state-sponsored threat group, has initiated a cyberattack campaign deploying the PlugX remote access tool (RAT). The attack utilizes a fake browser updater to trick users into downloading a multi-stage malware loader. This loader employs a combination of LNK and PowerShell scripts to sideload PlugX through a legitimate antivirus binary. The malware communicates with a hard-coded command and control (C2) server over HTTPS, using layered encryption to conceal its configuration. The campaign is characterized by its sophisticated methods and is indicative of the group's ongoing focus on espionage and data theft. Organizations using G DATA antivirus software may be particularly vulnerable to this attack. The current status of the campaign is active, with ongoing monitoring required. 2 sources 76

Extracted Entities

Mustang Panda Uses LNK, PowerShell Chain to Deploy PlugX RAT

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (3)

Tools (2)