Mustang Panda distributed PlugX malware through malicious optical disc image (ISO) files to entities in Europe.
The threat actor leveraged malicious shortcut (LNK) files and dynamic-link library (DLL) search-order-hijacking to carry out the four-stage infection chain.
Microsoft Windows registry run keys were used for persistence while symmetric cryptography and standard encoding were used to exfiltrate sensitive data.