Live OTX pulse data attributes renewed European government and diplomatic targeting to TA416, tracked as MUSTANG PANDA and assessed as China-aligned. After a reported Southeast Asia operational shift, the actor has re-focused on EU and NATO-facing diplomatic missions, with activity expanding in March 2026 and additional victimology touching Belgium, Iceland, Kosovo, Bangladesh, Syria, Kuwait and Iran. The campaign chain described in the pulse is consistent with TA416 tradecraft: web bug reconnaissance to validate mailbox and victim interest, delivery through compromised accounts or attacker-controlled infrastructure, Cloudflare Turnstile likely used as an anti-bot and analysis gate, then staged malware such as PlugX/Korplug, Sogu/Kaba, Thoper, TVT, DestroyRAT, TONESHELL and PUBLOAD. Objective: persistent espionage access to government and diplomatic communications, credential theft, collection of policy and negotiation material, and long-term C2. The 253 indicators are dominated by domains, so network egress controls, DNS telemetry and retro-hunting are higher value than hash-only blocking.
Threat Actor / Malware Profile
TA416 is closely associated with the Mustang Panda ecosystem and PlugX-family tooling. PlugX and Korplug are historically tied to DLL search-order side-loading: a signed or benign-looking executable launches from a user-writable directory and loads a malicious DLL placed beside it or dropped under ProgramData, AppData, Users Public or Windows Temp. Payload behavior commonly includes in-memory shellcode, reflective injection, named mutexes, encrypted configuration, scheduled task or Run-key persistence, and C2 over HTTPS, DNS or custom TCP with domain rotation. TONESHELL and PUBLOAD are loader or shellcode-oriented families in the same operational cluster, often used to stage final implants while reducing on-disk artifacts. Sogu/Kaba and Thoper/TVT references suggest modular tooling for collection, lateral movement or victim-specific tasking. Anti-analysis techniques to expect: Turnstile-gated delivery pages that block sandboxes, compromised sender accounts that pass SPF-aligned user context, sleep or jitter before beaconing, environment checks, geofencing, header validation, and domain fronting-like separation between lure, gate and C2 infrastructure.
IOC Analysis
The observable set is domain-led: atravelingwitch.com, creatday.com, fruitbrat.com, basecampbox.com, goodmedsx.com, hnk-capljina.com, ghonline.net and ombut.com are examples from a 253-indicator pulse. Treat domains as probable C2, staging, redirect or Turnstile-gated delivery infrastructure rather than assuming every resolution equals compromise. SOC operationalization should pivot across DNS query logs, proxy full URL, TLS SNI, JA3/JA3S where available, NetFlow, EDR network events and email gateway click telemetry. Enrich with passive DNS, registrar age, certificate transparency, ASN, first-seen and last-seen; expire block decisions only after sinkholing or confirming inactivity. Hashes are lower confidence for this pulse because PlugX loaders are frequently repacked per target; prioritize behavior detections for signed-binary side-loading, rundll32 or regsvr32 abuse from writable paths, suspicious child processes of Office or browser processes after lure interaction, and persistence in Run keys or scheduled tasks. Decode or detonate safely: URLScan, VirusTotal, Hybrid Analysis, ANY.RUN, Joe Sandbox, CAPE for config extraction, and CyberChef for quick string deobfuscation; keep live malware handling inside an isolated analysis VLAN.
Detection Engineering
---
title: TA416 PlugX Korplug DLL Side-Load From Writable Path
id: 7b2a94f1-3f0a-4f76-9b2d-ta416plugx01
status: experimental
description: Detects signed or common Windows binaries loading DLLs from user-writable locations consistent with PlugX Korplug side-loading.
author: Security Arsenal
date: 2026/09/04
logsource:
category: image_load
product: windows
detection:
selection_loader:
Image|endswith:
- 'rundll32.exe'
- 'regsvr32.exe'
- 'msiexec.exe'
- 'wscript.exe'
- 'cscript.exe'
- 'explorer.exe'
selection_path:
ImageLoaded|contains:
- 'AppData'
- 'ProgramData'
- 'Users/Public'
- 'Windows/Temp'
- 'Temp'
selection_dll:
ImageLoaded|endswith: '.dll'
filter_system:
ImageLoaded|contains:
- 'Windows/System32'
- 'Windows/SysWOW64'
- 'Program Files'
condition: selection_loader and selection_path and selection_dll and not filter_system
falsepositives:
- Enterprise software with poorly packaged plugins in ProgramData
- IT scripts using regsvr32 from temporary deployment folders
level: high
tags:
- attack.defense_evasion
- attack.t1574.002
- attack.t1218
- ta416
- plugx
---
title: TA416 Campaign Domain Resolution Or Egress
id: 9a41cd55-8ad1-4d11-a7f7-ta416dns02
status: experimental
description: Detects DNS or proxy egress to example OTX indicators associated with TA416 Mustang Panda European government espionage infrastructure.
author: Security Arsenal
date: 2026/09/04
logsource:
category: dns
detection:
selection:
query|contains:
- 'atravelingwitch.com'
- 'creatday.com'
- 'fruitbrat.com'
- 'basecampbox.com'
- 'goodmedsx.com'
- 'hnk-capljina.com'
- 'ghonline.net'
- 'ombut.com'
condition: selection
falsepositives:
- Threat research, sandbox detonation or analyst pivoting
level: critical
tags:
- attack.command_and_control
- attack.t1071
- attack.t1568
- ta416
---
title: TA416 Persistence Through Run Key With Scripting Or Loader
id: 5d0ef7ab-77d4-4c31-91b8-ta416run03
status: experimental
description: Detects Run-key persistence pointing to scripting hosts, rundll32, regsvr32 or writable-path binaries commonly used by PlugX-family implants.
author: Security Arsenal
date: 2026/09/04
logsource:
category: registry_set
product: windows
detection:
selection_run:
TargetObject|contains:
- 'CurrentVersion'
- 'Run'
selection_payload:
Details|contains:
- 'powershell'
- 'wscript'
- 'cscript'
- 'rundll32'
- 'regsvr32'
- 'AppData'
- 'ProgramData'
- 'Users/Public'
- 'Windows/Temp'
condition: selection_run and selection_payload
falsepositives:
- Corporate logon scripts and software updaters
level: high
tags:
- attack.persistence
- attack.t1060
- attack.t1547.001
- attack.t1059
let Ta416Domains = dynamic(['atravelingwitch.com','creatday.com','fruitbrat.com','basecampbox.com','goodmedsx.com','hnk-capljina.com','ghonline.net','ombut.com']);
let Lookback = 14d;
let Net = DeviceNetworkEvents
| where Timestamp >= ago(Lookback)
| where RemoteUrl has_any (Ta416Domains) or RemoteIP in (dynamic([]))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType;
let Dns = DeviceDnsEvents
| where Timestamp >= ago(Lookback)
| where Name has_any (Ta416Domains)
| project Timestamp, DeviceName, Name, IPAddresses, InitiatingProcessFileName;
let Proc = DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where (FileName in~ ('rundll32.exe','regsvr32.exe','wscript.exe','cscript.exe','powershell.exe','msiexec.exe')
and ProcessCommandLine has_any ('AppData','ProgramData','Users Public','Windows Temp','.dll','http','https'))
or InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe','msedge.exe','chrome.exe','firefox.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
union Net, Dns, Proc
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hits=count() by DeviceName, InitiatingProcessFileName, FileName, Name, RemoteUrl, RemoteIP, ProcessCommandLine
| order by LastSeen desc;
$ioc = @('atravelingwitch.com','creatday.com','fruitbrat.com','basecampbox.com','goodmedsx.com','hnk-capljina.com','ghonline.net','ombut.com')
$rx = ($ioc | ForEach-Object { [regex]::Escape($_) }) -join '|'
Write-Host '[*] DNS cache matches'
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match $rx -or $_.Data -match $rx } | Select-Object Entry,Data,TimeToLive
Write-Host '[*] TCP and UDP endpoints with suspicious process owners'
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq 'Established' } | ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; if ($p -and $p.Path -match 'AppData|ProgramData|Users/Public|Temp') { [pscustomobject]@{Local=$_.LocalAddress+':'+$_.LocalPort; Remote=$_.RemoteAddress+':'+$_.RemotePort; Process=$p.ProcessName; Path=$p.Path} } }
Write-Host '[*] Run key persistence'
'HKCU:/Software/Microsoft/Windows/CurrentVersion/Run','HKLM:/Software/Microsoft/Windows/CurrentVersion/Run','HKLM:/Software/WOW6432Node/Microsoft/Windows/CurrentVersion/Run' | ForEach-Object { Get-ItemProperty -Path $_ -ErrorAction SilentlyContinue } | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|ProgramData|Users/Public|Temp|rundll32|regsvr32|powershell|wscript|cscript' } | Select-Object Name,Value }
Write-Host '[*] Scheduled tasks launching from writable paths'
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.Execute -match 'AppData|ProgramData|Users/Public|Temp|powershell|wscript|cscript|rundll32|regsvr32' -or $_.Arguments -match 'AppData|ProgramData|Users/Public|Temp|http|https' } | Select-Object @{n='Task';e={$t.TaskName}},Execute,Arguments }
Write-Host '[*] Recent executables and DLLs in high-risk directories'
Get-ChildItem -Path $env:ProgramData,$env:LOCALAPPDATA,$env:PUBLIC,'C:/Windows/Temp' -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Extension -in '.exe','.dll','.dat','.tmp' -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Sort-Object LastWriteTime -Descending | Select-Object -First 250 FullName,Length,LastWriteTime
Response Priorities
Immediate: Block and sinkhole the listed domains at DNS, secure web gateway and EDR network control; alert on any historical resolution in the last 30-90 days, not just new connections. Quarantine mail containing European government, EU or NATO lures from compromised or lookalike senders; preserve headers, tracking pixel URLs and attachments. Hunt for rundll32, regsvr32, msiexec, wscript, cscript and PowerShell launched from writable paths, plus Office or browser processes spawning those interpreters. Isolate hosts with both IOC egress and persistence artifacts; collect memory before reboot for PlugX-family config extraction. 24h: Because diplomatic targeting frequently precedes credential theft and mailbox abuse, force password reset and MFA re-registration for exposed users, revoke OAuth grants and sessions, audit inbox rules, forwarding, delegated access and impossible travel. Search email gateway logs for web bug opens, Turnstile-gated links and replies from compromised accounts. Validate whether VPN, OWA, M365, ADFS or identity provider logs show token replay or anomalous consent. Expand pivots from the eight sample domains to co-resolving passive DNS, certificates, TLS fingerprints and hosting neighbors; add confirmed indicators to watchlists with expiry and confidence. 1 week: Harden against the observed vector: restrict DLL search-order side-loading by removing write permission beside approved signed binaries, enable WDAC or AppLocker for user-writable paths, block Office child processes, constrain rundll32 and regsvr32, and require script signing. Enforce DNS protective filtering, TLS inspection where lawful, and egress allow-listing for diplomatic-user segments. Deploy mailbox controls for external sender banners, link rewriting, pixel blocking or remote content isolation, and phishing-resistant MFA for high-risk officials. Build a standing TA416 hunt hypothesis around compromised account delivery, web bug validation, Turnstile gating, staged loaders and government data collection.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.