China-nexus Threat Actor Deploys PlugX in Persian Gulf Amid Middle East Conflict

On March 1, 2026, a China-nexus threat actor launched a cyber campaign targeting countries in the Persian Gulf region, coinciding with renewed conflict in the Middle East. The attack utilized social engineering tactics, featuring an Arabic-language document lure related to missile strikes. The multi-stage attack delivered a PlugX backdoor variant through a sophisticated chain involving a ZIP archive, Windows shortcut (LNK) files, and a malicious Compiled HTML Help (CHM) file. The campaign is attributed to a threat actor likely linked to Mustang Panda, with high confidence. The lure included a decoy PDF that depicted missile attacks, further enhancing its effectiveness. The attack's complexity involved obfuscated shellcode and DLL sideloading techniques, indicating a high level of sophistication. The threat remains active as of the latest reports.

Key Points: • A China-nexus threat actor targeted the Persian Gulf region using a PlugX backdoor. • The attack leveraged social engineering with an Arabic-language lure related to missile strikes. • The campaign is attributed to Mustang Panda with high confidence, indicating state-sponsored involvement.