Earth Preta’s Campaign Abusing MAVInject to Bypass Detection (Campaign)

Earth Preta (Mustang Panda) is observed conducting a targeted campaign against Asia-Pacific government entities using spear-phishing with decoy PDFs and DLL side-loading to deploy a TONESHELL backdoor. The group abuses a legitimate EA executable (OriginLegacyCLI.exe) for sideloading and leverages Microsoft Application Virtualization Injector (MAVInject.exe) to inject malicious code into waitfor.exe when ESET antivirus processes are detected, otherwise using WriteProcessMemory and CreateRemoteThreadEx. The malware decrypts shellcode from its .data section, establishes C2 to www.militarytc.com:443, and exfiltrates system information while supporting remote commands for shells and file manipulation, demonstrating refined persistence and detection-evasion TTPs.