STATICPLUGIN
MITRE ATT&CK: S1238 View on attack.mitre.org
Aliases: STATICPLUGIN
- Malware type
- downloader, loader
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 13:16:51
Targeted industries: government-and-public-sector
Context
STATICPLUGIN is a downloader known to be leveraged by Mustang Panda and was first observed utilized in 2025. STATICPLUGIN has utilized a valid certificate in order to bypass endpoint security protections. STATICPLUGIN masqueraded as legitimate software installer by using a custom TForm. STATICPLUGIN has been leveraged to deploy a loader that facilitates follow on malware.
Detection coverage
- 45 Sigma rules
Malware & tools used
- Code Signing (attack-pattern)
- Masquerade File Type (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- Malicious File (attack-pattern)
- Component Object Model (attack-pattern)
Used by threat actors
- Mustang Panda (threat-actor)
Reports & references
- cloud.google.com — Prc Nexus Espionage Targets Diplomats (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Staticplugin (report)
- MITRE ATT&CK — S1238 (report)