MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain

This PlugX malware campaign, attributed to Mustang Panda, employs a sophisticated, multi-stage execution chain leveraging DLL sideloading, multi-layer payload decryption, and stealthy persistence mechanisms to evade detection and establish encrypted C2 communications, underscoring the need for behavioral detection across the entire infection flow rather than reliance on static indicators.