Mustang Panda DLL Sideloading via Solid PDF Creator or Citrix Receiver

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects potential DLL sideloading activities where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver components load dynamic link libraries (DLLs) from non-standard or user-writable directory paths (e.g., Temp, AppData, Downloads). This behavior is characteristic of delivery chains associated with threat actor Mustang Panda, specifically utilizing loaders like SHARDLOADER or MINIRECON.