"Infrastructure rotates and payloads can change, but the execution model persists," Darktrace wrote — and that persistence is precisely what researchers say underpins a months-long espionage campaign that targeted organizations across the Asia‑Pacific and Japan.
Darktrace links activity to Mustang Panda with moderate confidence
New analysis from Darktrace describes cluster activity beginning in late September 2025 and continuing through April 2026. The company assessed with moderate confidence that the campaign aligns with tradecraft publicly associated with Mustang Panda, a China‑aligned group that Darktrace also tracks as Twill Typhoon and which is known by aliases including Earth Preta, Stately Taurus, Bronze President and TA416. Darktrace cautioned that the techniques observed are not unique to a single actor.
CDN impersonation and DLL sideloading observed across victims
Targets in the campaign retrieved a mix of legitimate executables, matching .config files and malicious DLLs from domains posing as well‑known content delivery networks, including impersonations of Yahoo and Apple infrastructure. In one finance‑sector incident from April 2026, an endpoint pulled legitimate binaries such as vshost.exe and dfsvc.exe, then fetched paired configuration and DLL components over an 11‑day window.
The attackers relied on a DLL sideloading chain: legitimate binaries were used to load malicious DLLs that carried the same filenames as expected libraries. Darktrace documented an example where a malicious browser_host.dll was placed alongside the legitimate Sogou Pinyin input method binary biz_render.exe, enabling execution of the payload inside that trusted process.
FDMTP 3.2.5.1: an updated .NET backdoor with modular plugins
Darktrace identified the final‑stage payload as a heavily obfuscated .NET backdoor, specifically version 3.2.5.1 of FDMTP. Trend Micro first documented FDMTP in 2024 as a Mustang Panda secondary control implant. The backdoor communicates over custom TCP using the Duplex Message Transport Protocol (DMTP). Observed features include cluster‑based resolution, token validation and a persistent message loop used for remote tasking.
Researchers found four loadable plugins in the framework: one to create scheduled tasks, one to establish registry persistence, one to load and persist the main framework itself, and one to retrieve files remotely and manipulate processes. Those modular components form the operational capabilities Darktrace observed during the campaign.
Persistence and an aggressive update channel
Persistence mechanisms documented by Darktrace include scheduled tasks and registry entries under HKCU\Software\Microsoft\IME. Separate from those mechanisms, the campaign used an update channel that polled icloud‑cdn[.]net every five minutes for new payloads, creating a frequent check‑in cadence for follow‑on components. Decoded strings in an observed sample loaded the .NET runtime in‑process and fetched the next stage directly into memory as a managed assembly.
What this means for technologists, affected enterprises, and defenders
- Technologists and security teams: the campaign highlights reliance on trusted binaries and in‑process loading. Darktrace specifically urged defenders to anchor detection to behavioral sequences rather than to static indicators, noting that infrastructure and payloads rotate while the execution model persists.
- Affected enterprises and procurement leaders: organizations running Sogou Pinyin and other third‑party binaries should note that legitimate executables can be abused for DLL sideloading; the finance‑sector case from April 2026 illustrates how long an attacker can operate while cycling components over days.
- Defenders and incident response teams: the presence of an update channel polling icloud‑cdn[.]net every five minutes and scheduled‑task/registry persistence under HKCU\Software\Microsoft\IME are concrete sequences to examine alongside detection approaches that focus on process ancestry and in‑memory .NET activity.
Conclusion
Darktrace's report documents an espionage campaign that paired classic sideloading techniques and CDN impersonation with an updated, modular .NET backdoor — FDMTP 3.2.5.1 — and a frequent update cadence. The firm’s central recommendation is procedural: prioritize behavioral detection anchored to the execution sequence rather than transient indicators. The facts in Darktrace’s analysis leave a clear operational question: as infrastructure and payloads continue to change, will defenders adjust detection to follow the sequence of activity before the next rotation completes?
