Lab52 analysts documented in a report published on Lab52 a Mustang Panda campaign deploying a new PlugX variant against Taiwanese government entities and diplomats, sharing multiple infrastructure and artifact similarities with the SmugX campaign (attributed to Red Delta/Mustang Panda). Two distinctive technical departures from prior PlugX campaigns: the malicious loader DLL is written in the Nim programming language, and the RC4 implementation used to decrypt PlugX is custom rather than relying on the Windows Cryptsp.dll library.
MSI-Based Delivery: DLL Sideloading via OneNotem.exe
The installer 45dd12.msi contains three components: legitimate executable OneNotem.exe, malicious Nim-written loader msi.dll, and encrypted payload NoteLogger.dat. On execution, the MSI copies all three files to C:\Users\[user]\AppData and copies OneNotem.exe to one of five possible directories: VirtualFile, SamsungDriver, or SecurityScan under either the user profile or Public. Persistence is achieved via the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneNote Update pointing to the legitimate binary. On execution, OneNotem.exe first checks internet connectivity via www.google.com, then contacts C2 domains ivibers[.]com and meetvibersapi[.]com over HTTPS port 443, and creates a mutex to prevent duplicate execution.
Nim Loader DLL: Reduced Export Surface and Custom RC4 Decryption
The loader's DllMain is modified to call NimMain on load — loading only required functions and reducing the exported function count to complicate analysis and detection. When OneNotem.exe calls MsiProvideQualifiedComponentW, the DLL reads NoteLogger.dat via CreateFileW, copies its contents to a memory section, and decrypts the embedded PlugX DLL using a custom RC4 implementation with hardcoded key EtFOWV4hDJf6DA6W. The decrypted DLL is executed at offset 0x00 in the memory page using an EnumSystemGeoID callback — a known shellcode execution technique that avoids more commonly monitored API calls.
PlugX Configuration: Campaign ID "tw" and Taiwanese Election Decoy
The NoteLogger.dat payload contains a PlugX variant with a small shellcode at offset 0x00 that calls the DLL's only export. The decrypted .data section configuration reveals campaign ID "tw" (Taiwan), C2 servers ivibers[.]com and meetvibersapi[.]com both on port 443 over HTTPS, and the decoy document name in Traditional Chinese referencing Terry Gou's announcement of his independent presidential candidacy with Lai Peixia as running mate — an event of high political sensitivity given Gou's connections to the Western technology supply chain (Foxconn, major supplier to US/European/Japanese manufacturers) and the implications for Taiwan-China trade relations and the semiconductor manufacturing cluster. The election-themed lure targets the same diplomatic and governmental audience as prior SmugX activity.