Mustang Panda — ZOHOMURK / MINIRECON / SHARDLOADER

Mustang Panda, a China-aligned espionage actor, was reported by Acronis TRU on 2026-06-30 running two campaigns against government and hydropower/energy targets. The operators pair three tools: SHARDLOADER (a DLL side-loader), MINIRECON (a reworked variant of the actor's Toneshell backdoor), and ZOHOMURK (a novel implant that abuses Zoho WorkDrive as command-and-control).

Delivery is spearphishing: ZIP archives (lures themed Hydropower Cooperation Project Proposal and MOI ROSINFO DU TAIWAN) carry a legitimately-signed executable — a Solid PDF Creator binary in one campaign, a Citrix Receiver binary in the other — alongside a hidden malicious DLL (pl2bmpax.dll / txMuiApp.dll). Running the signed EXE side-loads the DLL. Persistence is a scheduled task (SolidPDFPcl2Bmp) and an HKCU Run key created under the misspelled value RunOnece. MINIRECON beacons over a WebSocket-on-HTTPS channel to couldinstallup[.]com (199.209.141.166); ZOHOMURK uses hardcoded Zoho OAuth credentials to read tasking from an inbox folder and write stolen data to an outbox folder in Zoho WorkDrive.

Highest-value defensive angle: the side-loading is the loud, portable signal — a signed Solid PDF Creator / Citrix Receiver binary executing from a user-writable path (an extracted ZIP), loading a DLL that shouldn't live there. The Zoho WorkDrive C2 is the quiet one: SaaS traffic to Zoho is normal, so the tell is a non-browser process talking to Zoho endpoints.

Defender priority: Hunt signed-binary side-loading from user-writable paths (Q1/Q2), then run the two atomic-IOC hunts for couldinstallup[.]com / 199.209.141.166 (Q6/Q7). Both C2 indicators are vendor-published — promote them to blocking now; treat any hit as a suspected nation-state intrusion and escalate.

Intel note: the domain couldinstallup[.]com and IP 199.209.141.166 are vendor-published atomic IOCs (high confidence, campaign-specific). File hashes were not published in the reviewed reporting; the DLL names (pl2bmpax.dll, txMuiApp.dll) are legitimate component names being hijacked, so they are behavioral (path-qualified), not standalone blocks.

Hypotheses (fidelity-ordered)

1. H1 (high): A signed Solid PDF Creator or Citrix Receiver binary executing from a user-writable path (extracted ZIP) is a SHARDLOADER side-load host.
2. H2 (high): The malicious loader DLL (pl2bmpax.dll / txMuiApp.dll) written to a user/temp path next to the signed EXE marks the drop.
3. H3 (high): A scheduled task named SolidPDFPcl2Bmp is actor persistence.
4. H4 (high): An HKCU Run value named RunOnece (the actor's typo) is autostart persistence.
5. H5 (medium): A non-browser process resolving/connecting to Zoho WorkDrive endpoints is ZOHOMURK cloud C2.
6. H6 (high): Any resolution of couldinstallup[.]com or connection to 199.209.141.166 is MINIRECON C2.

Attack chain

• Email gateway: hunt inbound ZIP attachments matching the lure themes (hydropower, ROSINFO, Taiwan MOU) and any ZIP containing a signed EXE + hidden DLL pair.
• Zoho WorkDrive admin/audit: if you use Zoho, review WorkDrive access logs for OAuth app grants and API access from unexpected client IDs; look for automated inbox/outbox folder read/write patterns.
• Web proxy / SASE: flag requests to Zoho WorkDrive / zohoapis.com where the user-agent or client process is not a browser or the sanctioned Zoho desktop client.
• Scheduled Tasks: on suspect hosts, enumerate tasks and inspect any named SolidPDFPcl2Bmp or pointing at a user-writable executable path.
• Registry: review HKCU\Software\Microsoft\Windows\CurrentVersion\Run for a value named RunOnece.

Keep Q5 (Zoho) investigate-only until browser/Zoho-client exclusions are baselined — it targets a legitimate SaaS destination.

A · Enable the two key ASR rules (PowerShell)

# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
  -AttackSurfaceReductionRules_Actions Enabled
# Block execution of potentially obfuscated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
  -AttackSurfaceReductionRules_Actions Enabled
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

B · Hunt + remove the persistence (PowerShell — run per suspect host)

# Scheduled task
Get-ScheduledTask | Where-Object { $_.TaskName -eq 'SolidPDFPcl2Bmp' } |
  Format-List TaskName, TaskPath, State
# HKCU Run typo value
$rk = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
Get-ItemProperty -Path $rk | Select-Object -Property RunOnece -ErrorAction SilentlyContinue
# After confirming malicious, remove:
#   Unregister-ScheduledTask -TaskName 'SolidPDFPcl2Bmp' -Confirm:$false
#   Remove-ItemProperty -Path $rk -Name 'RunOnece'

C · WDAC-style path rule (block signed EXE running from user paths)

# AppLocker EXE deny rule (illustrative) — deny execution from user-writable roots,
# allow Program Files. Deploy via GPO: Application Control Policies -> AppLocker.
#   Deny: %OSDRIVE%\Users\*   (Everyone)
#   Deny: %TEMP%\*            (Everyone)
#   Allow: %PROGRAMFILES%\*   (Everyone)
# Pilot in Audit mode first, then switch to Enforce.

Validation: the strongest coverage is the persistence pair (Q3/Q4) and the atomic C2 IOCs (Q6/Q7) — deploy those first. The ZOHOMURK cloud channel (Q5) is genuinely harder because Zoho traffic is legitimate; treat it as investigate-only and lean on SaaS/CASB logs. No file hashes were published, so in-memory backdoor internals are an accepted gap.