DarkPeony’s Trail: Certificate Patterns Point to Sustained Campaign Infrastructure

Viettel Threat Intelligence tracks Goblin Panda (aka Hellsing, 1937CN) campaigns exploiting COVID-19 themes, using RTF exploits and PlugX/NewCoreRAT to breach government targets and evade most AVs.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

This threat intelligence report documents active targeting of critical national infrastructure and defense contractors through edge application vulnerabilities.

Hunt.io maps two malicious server clusters—Earth Baxia and suspected PlugX—found via anomalous Cloudflare certificates, fake 'Microsoft' self-signed certs and 301 redirects to FBI, NASA and eBay.

Part three of the Mustang Panda series analyzes the THOR PlugX variant: DLL side-loading via a signed BitDefender binary, OLLVM obfuscation, and config decryption revealing C2 details.