Vietnamese Entities Targeted By China’s Mustang Panda

Cyble Research Intelligence Labs documents Mustang Panda (China-linked) APT campaigns targeting Vietnamese tax and education sectors in Apr–May 2024 that deliver multi-stage malware via malicious LNK attachments; attackers abuse legitimate utilities (forfiles, mshta), use obfuscated PowerShell/VBScript, DLL sideloading and in-memory loaders/shellcode to contact C2 servers, with comprehensive IOCs and MITRE ATT&CK mappings provided.