The Chinese APT hacking group "Mustang Panda" has been spotted abusing the Microsoft Application Virtualization Injector utility as a LOLBIN to inject malicious payloads into legitimate processes to evade detection by antivirus software. The abuse starts with the Microsoft Application Virtualization Injector (MAVInject.exe), a legitimate Windows system tool that allows the operating system to inject code into running processes. Mustang Panda's targeting scope, based on Trend Micro's visibility, includes government entities in the Asia-Pacific region, while the primary attack method is spear-phishing emails that appear to come from government agencies, NGOs, think tanks, or law enforcement. Mustang Panda abuses the executable to inject malicious payloads into 'waitfor.exe,' a legitimate Windows utility that comes pre-installed in Windows operating systems. When ESET antivirus products are detected (ekrn.exe or egui.exe) on a compromised machine, Mustang Panda employs a unique evasion mechanism exploiting tools pre-installed on Windows 10 and later. Being a trusted system process, the malware that is injected in it passes as a normal Windows process, so ESET, and potentially other antivirus tools, does not flag the malware's execution. Trend Micro believes with medium confidence that this new variant is a custom Mustang Panda tool based on its functional characteristics and previously documented packet decryption mechanisms. The legitimate function of waitfor.exe on Windows is to synchronize processes across multiple machines by waiting for a signal or command before executing a specific action. The threat group was previously seen in attacks targeting governments worldwide using Google Drive for malware distribution, custom evasive backdoors, and a worm-based attack chain. The emails spotted by Trend Micro contain a malicious attachment containing the dropper file (IRSetup.exe), a Setup Factory installer. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 18 Feb 2025 18:05:15 +0000