MUSTANG_PANDA__2023__JSAC2023_2_LT4.pdf

TeamT5 analysis: MustangPanda (Polaris) persists in using and evolving the PlugX family (PlugDisk, PlugX Fast and a new 'MiniPlug' miniaturized variant) to run frequent, targeted campaigns—notably expanding into EU governmental targets. The report documents modified payload encoding schemes and control-flow flattening/obfuscation, distribution via malicious downloaders, ISOs and USB methods, numerous sample hashes and C2 IPs/URLs, and indicates active, ongoing operations with rotated infrastructure and reused shellcode linking activity to the group.