Mustang Panda Campaign II SHARDLOADER/ZOHOMURK DLL Sideload Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.