Cyble Research and Intelligence Labs documented in a report published on Cyble Research and Intelligence Labs two Mustang Panda campaigns targeting Vietnamese entities in April and May 2024, using LNK files with double-extension masquerading (PDF and DOCX) and partial lure document embedding to inflate file size and evade detection. Both campaigns share C2 infrastructure, confirming continuous operation across the two waves. The campaigns use tax compliance (May 2024) and English education course (April 2024) themes to target Vietnamese government and education sector individuals.
Campaign 1 (May 2024): forfiles.exe Abuse to HTA-VBScript-PowerShell-DLL Sideloading Chain
The LNK file (Vanban_8647_cuong_che_thi_hanh_quyet_dinh.pdf.lnk) abuses the legitimate Windows forfiles.exe utility — normally used for batch file operations — to execute a PowerShell command launching mshta to fetch a remote HTA file (Vanban_8647.PDF_update.hta) from hxxp://mega.vlvlvlvl[.]site. The HTA file contains a VBScript that XOR-deobfuscates (key: bit 1) an embedded string, passing it to wscript as a Base64-encoded PowerShell command. Decoded, this executes a remote PS1 script (Vanban_8647.PDF.ps1) that drops three components: the legitimate HP.exe and malicious HPCustPartUI.dll to %APPDATA%\HPCustPartic\ for DLL sideloading, and a decoy Vanban_8647.PDF.hta to C:\Users\Public\ that hex-decodes a Vietnamese tax compliance PDF lure and opens it.
Loader DLL and Shellcode: RC4 MAC Address Beacon to C2
The sideloaded HPCustPartUI.dll creates mutex 90ace125-2ec6-4e55-ac63-a4e97820094eA, establishes persistence via a Run registry entry for HP.exe, then downloads an encrypted tempdata.dat from payment.tripadviso.online. After in-memory decryption the DAT yields a PE file without a PE header exposing an export function "start." Control transfers to this shellcode via CALL EAX(). The shellcode decrypts its strings using single-byte XOR key 0x9, creates a second mutex (f6e88e7f-4852-4e9f-8f5a-1895ad4b228d), retrieves the victim's MAC address via GetAdaptersInfo(), RC4-encrypts and Base64-encodes it, and transmits it to the C2 at back.vlvlvlvl.site.
Campaign 2 (April 2024): Education Lure, Updater.bat Startup Persistence, and Dual-DLL Sideloading
The education-themed campaign uses a ZIP containing huongdan_dangky_phuluc_so_2.docx.lnk, which downloads a legitimate English course decoy Word document and a PowerShell script (init.txt). The PS1 script downloads newrun.ps1 and newrun.jpg, copying the latter to the startup folder as Updater.bat for persistence. Updater.bat downloads and executes two PS1 scripts from hxxp://megacybernews[.]com: getdata.ps1 (system reconnaissance — systeminfo, ipconfig, netstat, tasklist, whoami, domain admins — exfiltrated via POST to /checkin.php) and stage2.2.ps1 (downloads book.dll, unikey.exe, and wwlib.dll, where book.dll is executed via rundll32 and wwlib.dll is sideloaded by unikey.exe — a renamed legitimate WinWord.exe). Both DLL loaders retrieve encrypted DAT files and load shellcode connecting to C2 in a chain consistent with PlugX RAT delivery.