Panda Goes Full Global
How MustangPanda refuses to abandon PlugX
Still Hsu

whoamiStill Hsu / Azaka Sekai 安坂星海
Threat Intelligence Researcher @ TeamT5
Topic of interest.NETWindowsGaming & malware reverse engineering
Non-binary (they/them)

Disclaimer
Collaborated research with Sean Sabo @ Recorded Future

History

History Lesson Time!
Polaris (better known as MustangPanda)
has been active since 2011.
◆ China-based APT group◆ Highly interested in antique infection
methods via USB devices (especially post2019) or third-party web hosts.
◆ Previously focused its campaigns on(South) East Asian territories◆ Myanmar◆ Mongolia◆ Philippines◆ Japan◆ …many more◆History Lesson Time!
Polaris loves using PlugX and refuses toabandon it.
◆ Various PlugX variants were developedover the years◆◆

PlugX Fast◆◆

PlugDisk◆◆“THOR” variant
PlugX + UDiskShell/USB infection ability

MiniPlug
Miniaturized/rewrite version of PlugX◆ we’ll get to this one later◆

History Lesson Time!

So what’s new?
◆Expanded territory◆New tech (but also not really)◆Less blatant (but also not really)

Expanded Territory

Previously…
NUMBER OF SAMPLES BETWEEN 2019 TO 2021 BY REGION*

Other, 35, 34%

Asia, 57, 55%

Europe, 12, 11%* Illustrative purposes only – may not be representative of samples in-the-wildNow…
NUMBER OF SAMPLES BETWEEN 2019 TO 2022 BY REGION*

Other, 52, 34%

Asia, 72, 47%

Europe, 29, 19%* Illustrative purposes only – may not be representative of samples in-the-wild

So what happened?
A quick rundown in ten minutes or so...

Another Brief History Lesson◆

Everything before...
Prepended 10-byte XOR decoding key in blobs◆ Used simple stack strings to avoid basic
detections◆◆

Late 2020◆◆

Increased XOR key length

Late 2021
Detected PlugDisk◆ New payload encoding scheme◆ Control-flow flattening obfuscation began tocrop up◆◆

Custom OLLVM implementation

Earlier stackstring-only command handler

Control-flow flattened command handler

New payload encoding scheme

Another Brief History Lesson
Some time around mid January 2022, amysterious sample triggered our detection
system.
◆ State_aid__Commission_approves_
20222027_regional_aid_map_for_Greece.exe◆ d404e3cd5f1c6a50f10f56f5c5b9c1e3◆ What did the detection flag the sample as?
PlugDisk◆

Execution flow

Execution flow

Slightly modified payload encoding scheme

But hang on...
Polaris had barely specifically targeted EU
up until this point.
◆ TTPs are wildly different from before.
◆

Different payload encoding scheme◆ Downloader◆ Targets EU◆ Slightly different PlugX behavior◆But hang on...
◆Slightly different PlugX behavior
Much smaller PlugX◆ Contains fewer command code support◆ HTTP headers are now almost completelydifferent from before◆ Hard to fully disassemble due to the level ofobfuscation◆◆

We now refer this variant as MiniPlug due
to the miniaturized nature of itWe kept observing...
◆

Polaris continued to tamper with theencoding schemes◆ Single-byte XOR◆ Single-byte XOR + appended shellcode◆

We’ll get back to thisSkipping X number of bytes + singlebyte XOR◆ Mathematical XORs based on filesizes◆

Use of archive files and obscure file paths.
◆ EU-targeted attacks continue along withother campaigns and regions featuringPlugX and other custom malware◆

We kept observing...
The appended shellcode could be dated
back much earlier on in the operation thatwas previously attributed to Polaris back in2018.
◆ Code reuse -> further attributing the attackto Polaris◆Self-XORing shellcode loaderWe kept observing...

◆Over the last few months, they’ve continued to evolve TTPs by...
Started experimenting with more and more launchers◆ Started using ISOs as distribution method◆ Extremely frequent attacks (at least once or twice per month)◆General background to the Red-White-Red - Card.docx
Political Guidance for the new EU approach towards Russia.docx
Unilateral statement by the Commission on migration.docx
Godišnji izveštaj EK o Srbiji.pdf
Written comments of Hungary.docx
draft letter to European Commission. RUSSIAN OIL PRICE CAP sg de.docx
st15935-en22.pdf
Summary MSs reporting - recommendation.docx

Bundled decoy document within the PE
Rotated C2 servers almost every attack

Conclusion◆

Polaris/MustangPanda is continuing to evolve their TTPs
Frequent attacks◆ Now carry multiple campaigns focusing on a wide variety of targets◆

EU-related governmental entities <-> MiniPlug◆ Asia-focused USB spreader/general monitoring <-> PlugDisk / PlugX Fast◆◆◆

Long-time operation

SEA-focused high-profile ops <-> NoFive◆

Perhaps another day...

THANK YOU!
links.azaka.fun
still@teamt5.org

sean.sabo@recordedfuture.com