Mustang Panda DLL Sideloading via Solid PDF Creator or Citrix Receiver

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•3

Detects DLL sideloading activity attributed to the Mustang Panda group, where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver are used to load potentially malicious DLLs (e.g., SHARDLOADER, MINIRECON, ZOHOMURK) from non-standard, user-writable directories including ProgramData, Public folders, and Temp directories.