S1238 STATICPLUGIN

malwareEnterprise

platformsWindows

also known asSTATICPLUGIN

STATICPLUGIN is a downloader known to be leveraged by Mustang Panda and was first observed utilized in 2025. STATICPLUGIN has utilized a valid certificate in order to bypass endpoint security protections. STATICPLUGIN masqueraded as legitimate software installer by using a custom TForm. STATICPLUGIN has been leveraged to deploy a loader that facilitates follow on malware.

techniques used (5)

ATT&CK techniques this enables or maps to.

T1036.005Match Legitimate Resource Name or Location
T1036.008Masquerade File Type
T1204.002Malicious File
T1553.002Code Signing
T1559.001Component Object Model

used by groups (1)

Threat groups associated with this.

G0129Mustang Panda

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan