[TLP:White] The #APT Mustang Panda group targets the Vatican state with lures. This uses the TTPs already used for pushing the payloads as vulnerable Word version (office 2007) by side-loading method for execute a dll. 
This dll perform a request for getting the dat file (configuration file) for the PlugX implant, performs a side-loading technique on another vulnerable software (Adobe AAM) for execute it.
By tracking the group which use this vulnerable software and the TTPs, this gives the attribution to Mustang Panda. This is the second time that the group targets the catholic organizations due to this have targets Union of Catholic Asian News.
This is a news agency that covers issues and subjects of interest to the Catholic Church on the Asian continent and located in Hong Kong and that was launched in 1979. This is due to the event with Coadjutor Bishop Augustine Cui Tai of Xuanhua was taken by Chinese officials.
We can note the rotation of the domain C2 on the IP delivery to IP C2 and how is managed the infrastructure.
Thanks to @JAMESWT_MHT for have tagged these samples and put at my disposal.
Ref anyrun :
app.any.run/tasks/6c5cff49…
app.any.run/tasks/e0a784c1…
Thanks to @JAMESWT_MHT for have tagged these samples and put at my disposal.
Ref anyrun :
app.any.run/tasks/6c5cff49…
app.any.run/tasks/e0a784c1…
