RedDelta Modified PlugX Infection Chain Operations

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. RedDelta Modified PlugX Infection Chain Operations was executed by Mustang Panda from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. RedDelta Modified PlugX Infection Chain Operations involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load PlugX on victim machines in a persistent state.(Citation: Recorded Future RedDelta 2025)

This is a historical record and does not establish current campaign activity.

Threat actor

Mustang Panda

Attribution confidence

Not established

First documented activity

2023-07-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2023-07-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1059.001 · PowerShell

  Execution — Mustang Panda used LNK files to execute PowerShell commands leading to eventual PlugX installation during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1071.001 · Web Protocols

  Command And Control — Mustang Panda used HTTP POST messages for command and control from PlugX installations during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1553.002 · Code Signing

  Defense Impairment — Mustang Panda used legitimate, signed binaries such as `inkform.exe` or `ExcelRepairToolboxLauncher.exe` for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1090 · Proxy

  Command And Control — Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1608.001 · Upload Malware

  Resource Development — Mustang Panda staged malware on adversary-controlled domains and cloud storage instances during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1574.001 · DLL

  Stealth, Execution — Mustang Panda used DLL search order hijacking on vulnerable applications to install PlugX payloads during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1095 · Non-Application Layer Protocol

  Command And Control — Mustang Panda communicated over TCP 5000 from adversary administrative servers to adversary command and control nodes during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1480 · Execution Guardrails

  Stealth — Mustang Panda included the use of Cloudflare geofencing mechanisms to limit payload download activity during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1082 · System Information Discovery

  Discovery — Mustang Panda captured victim operating system type via User Agent analysis during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1547.001 · Registry Run Keys / Startup Folder

  Persistence, Privilege Escalation — Mustang Panda used Run registry keys with names such as `OneNote Update` to execute legitimate executables that would load through search-order hijacking malicious DLLS to ensure persistence during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1203 · Exploitation for Client Execution

  Execution — Mustang Panda used the GrimResource exploitation technique via specially crafted MSC files for arbitrary code execution during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1566.002 · Spearphishing Link

  Initial Access — Mustang Panda distributed malicious links in phishing emails leading to HTML files that would direct the victim to malicious MSC files if running Windows based on User Agent fingerprinting during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1027.013 · Encrypted/Encoded File

  Stealth — Mustang Panda stored installation payloads as encrypted files in hidden folders during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1566.001 · Spearphishing Attachment

  Initial Access — Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1204.002 · Malicious File

  Execution — Mustang Panda distributed malicious LNK objects for user execution during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1036.004 · Masquerade Task or Service

  Stealth — Mustang Panda masqueraded Registry run keys as legitimate-looking service names such as `OneNote Update` during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1564.001 · Hidden Files and Directories

  Stealth — Mustang Panda stored encrypted payloads associated with PlugX installation in hidden directories during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1588.004 · Digital Certificates

  Resource Development — Mustang Panda acquired Cloudflare Origin CA TLS certificates during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1218.007 · Msiexec

  Stealth — Mustang Panda initial payloads downloaded a Windows Installer MSI file that in turn dropped follow-on files leading to installation of PlugX during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1583.001 · Domains

  Resource Development — Mustang Panda registered adversary-controlled domains during RedDelta Modified PlugX Infection Chain Operations that were re-registrations of expired domains.(Citation: Recorded Future RedDelta 2025)

• T1218.014 · MMC

  Stealth — Mustang Panda used Microsoft Management Console Snap-In Control files, or MSC files, executed via MMC to run follow-on PowerShell commands during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

• T1204.001 · Malicious Link

  Execution — Mustang Panda distributed hyperlinks that would result in an MSC file running a PowerShell command to download and install a remotely-hosted MSI file during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0047

  Official MITRE ATT&CK campaign record C0047. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.