China-Linked Hackers Hijack Web Traffic to Deliver Backdoor

SecurityWeek reports that a China-linked cyberespionage group, UNC6384, believed to be associated with Mustang Panda, hijacked web traffic to deliver the PlugX backdoor to diplomats and other targets. The operation, identified in March 2025 and described by Google Threat Intelligence Group as employing social engineering, signed malware, and adversary-in-the-middle techniques, uses a captive portal redirect to deploy the StaticPlugin downloader, which then loads a PlugX variant in memory.

The StaticPlugin malware was signed with a certificate issued by GlobalSign for Chengdu Nuoxin Times Technology Co., Ltd., a detail GTIG notes is part of multiple campaigns signed for that company. Attacks involve convincing victims to install what appears to be an Adobe plugin update, followed by a multi-stage chain designed to evade detection and maintain stealth. The backdoor can upload and download files from its C2 server, collect system information, and execute a remote command shell.

According to GTIG, UNC6384 has also used compromised edge devices to mount the AitM attack and redirect victims to a landing page under its control.