Lab52 analysts documented in a report published on Lab52 a Mustang Panda campaign targeting Australian government entities in the geopolitical context of the AUKUS alliance — the Australia-United Kingdom-United States strategic military pact centered on nuclear-powered submarine technology. The lure targets Australian Secretary of State for Trade and Tourism Senator Hon Don Farrell, using a ZIP archive named Biography of Senator the Hon Don Farrell.zip, indicating a targeted spearphishing operation against Australian government officials.
Infection Chain: DLL Sideloading via Renamed Solid PDF Creator with Dual Persistence
The ZIP drops two files: the legitimate Solid PDF Creator application renamed as Biography of Senator the Hon Don Farrell.exe, and a malicious loader SolidPDFCreator.dll. A cmd.exe command orchestrates the full installation: copying SolidPDFCreator.dll to C:\Users\Public\Libraries\PhotoTvRHD\, adding a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SolidPDF pointing to SolidPDFCreator.exe), and creating a scheduled task also named SolidPDF set to trigger every minute. The dual persistence mechanism — both registry Run key and per-minute scheduled task — ensures redundant execution guaranteeing C2 connectivity even if one persistence method is removed.
Stager C2: Microsoft Host Header Masquerade Against 123.253.35[.]231
Rather than delivering PlugX directly, the campaign uses a custom-developed stager that provides the attacker with a reverse shell used subsequently for PlugX deployment — consistent with techniques described in prior Talos and Cisco reporting on Mustang Panda operations. The stager impersonates Microsoft update communications by hardcoding the legitimate host header www.asia.microsoft.com while directing traffic to the actual C2 at 123.253.35[.]231, a technique designed to cause network monitoring tools to log the traffic as legitimate Microsoft update activity and bypass domain-based filtering controls.
AUKUS Geopolitical Context: China's Documented Response to Indo-Pacific Military Realignment
The campaign directly follows China's official characterization of AUKUS as "destabilising" and "provocative" — with China's Foreign Ministry spokesperson citing Australian contribution to nuclear proliferation and regional arms race escalation. Lab52 had pre-assessed the likelihood of China-affiliated actors, particularly Mustang Panda, targeting Australian government organizations in response to the AUKUS agreement's direct challenge to China's Indo-Pacific strategic positioning. The campaign illustrates how state-affiliated cyber actors rapidly translate geopolitical friction into targeted intrusion operations against officials most directly involved in the affected policy domains — in this case, Australia's trade and diplomatic apparatus.