Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware

The article reports that the China-linked threat actor Mustang Panda has refined its cyber espionage toolkit with a new DLL side-loading technique, first identified by IBM’s X-Force in June 2025 and linked to a Tibetan-focused campaign. The infection chain begins with a weaponised ZIP file containing an innocuous‑looking executable named Voice for the Voiceless Photos.exe, which hides a DLL named libjyy.dll that remains invisible to users.

The DLL uses a –arhs– attribute combination to stay stealthy, and the loader then employs LoadLibraryW to call the ProcessMain function, while the hidden libjyy.dll masquerades as software from Wargaming[.]net Game Center as the Claimloader malware. The campaign deploys a multi-stage payload, including a lightweight loader that decrypts and loads shellcode, and a secondary component for exfiltration that uses API hashing with the single-byte key 0x19.

Persistence is achieved via registry Run keys and a scheduled task named AdobeExperienceManager that runs every two minutes, ensuring continued access even if one mechanism is discovered.