Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Viettel Threat Intelligence tracks Goblin Panda (aka Hellsing, 1937CN) campaigns exploiting COVID-19 themes, using RTF exploits and PlugX/NewCoreRAT to breach government targets and evade most AVs.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

Hunt.io follows certificate patterns—'AES' organizational units and shared issuers—to extend infrastructure tied to DarkPeony, a Chinese espionage group targeting governments and militaries.

Part three of the Mustang Panda series analyzes the THOR PlugX variant: DLL side-loading via a signed BitDefender binary, OLLVM obfuscation, and config decryption revealing C2 details.

Part two of the Mustang Panda series covers the XOR 2 PlugX variant: control flow flattening, FNV-1a API hashing, obfuscated strings, a new Campaign ID field, and UAC bypass via Fodhelper/eventvwr.