MUSTANG_PANDA__2022__BRONZE_PRESIDENT_Targets_Government_Officials_Secureworks.pdf

Secureworks CTU describes a targeted PlugX campaign attributed to the BRONZE PRESIDENT APT that used RAR archives containing LNK shortcuts, DLL search-order hijacking, and encrypted PlugX payloads to compromise government officials in Europe, the Middle East, and South America; the report includes technical analysis of execution, persistence (registry Run key), anti-analysis techniques, and a comprehensive set of IoCs (file hashes and C2 IPs) for detection and mitigation.