MITRE ATT&CKsoftware (malware)

S1237 CANONSTAGER

Published 2025-09-12 Modified 2025-10-22 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.0
Created: 2025-09-12

Description

CANONSTAGER is a loader known to be leveraged by Mustang Panda and was first observed utilized in 2025. Mustang Panda utilizes DLL side-loading to execute within the victim environment prior to delivering a follow-on malicious encrypted payload. CANONSTAGER leverages Thread Local Storage (TLS) and Native Windows APIs within the victim environment to elude detections. CANONSTAGER also hides its code utilizing window procedures and message queues.

Uses · MITRE ATT&CK (6)

T1027.007 Dynamic API Resolution sub-technique
T1564.003 Hidden Window sub-technique
T1574.001 DLL sub-technique
T1036.005 Match Legitimate Resource Name or Location sub-technique
T1055.005 Thread Local Storage sub-technique
T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

G0129 Mustang Panda group

References

https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025

S1237 CANONSTAGER

Description

Related

Uses · MITRE ATT&CK (6)

Referenced by MITRE ATT&CK · uses (1)

References