Executive Summary
A multi-stage malware campaign attributed to the threat actor Mustang Panda (also known as Bronze President or RedDelta) utilizes a diplomatic-themed lure referencing the Organization of Islamic Cooperation (OIC). The infection starts with a malicious shortcut (.lnk) that triggers a chain of living-off-the-land techniques to download and execute the PlugX remote access trojan (RAT).
The attack employs sophisticated defense evasion, including DLL side-loading via a Jarte-derived application and the use of an XOR-obfuscated payload (irun.dat). Once established, the malware provides the adversary with extensive remote control capabilities, including file management, process discovery, and host profiling, while maintaining persistence through registry modifications.
This campaign highlights a high threat to diplomatic, government, and international affairs sectors. The technical maturity of the infection chain—combining social engineering with legitimate application abuse—necessitates immediate attention to behavior-based detections for PowerShell-driven downloads and unauthorized persistence in public directories.