Mustang Panda MINIRECON/ZOHOMURK DLL Injection via SolidPDFCreator or ctxmui Sideload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.