9/3/25, 9:24 PM

According to Cado Security Labs (now part of Darktrace), a malware campaign targeting the Royal Thai Police has been attributed to the Chinese APT group Mustang Panda, with activity documented in February 2025. The campaign uses seemingly legitimate FBI-themed documents to deliver a shortcut file that then executes Yokai, the backdoor, on the victim’s system.

Technical analysis shows the initial access likely came via phishing, with a LNK file inside a rar archive and a disguised PDF, looping through an FTP script to run commands. The operation includes obfuscated payloads and a trojanised PDF-XChange Driver Installer named PrnInstallerNew.exe to enable persistence and C2 communications.

Darktrace notes that the Yokai backdoor communicates with a C2 host and that the attacker can achieve persistence via registry Run Keys, while creating a mutex to avoid duplicate instances. The piece also highlights the broader pattern of Mustang Panda activity against governments and NGOs in Asia, Europe and the United States, with emphasis on decoy documents and DLL sideloading techniques.