Chinese hackers abuse Microsoft APP-v tool to evade antivirus

Update 2/18/25: Added ESET's statement to the end of the article. The Chinese APT hacking group "Mustang Panda" has been spotted abusing the Microsoft Application Virtualization Injector utility as a LOLBIN to inject malicious payloads into legitimate processes to evade detection by antivirus software. This technique was discovered by threat researchers at Trend Micro, who track the threat group as Earth Preta, reporting that they have verified over 200 victims since 2022. Mustang Panda's targeting scope, based on Trend Micro's visibility, includes government entities in the Asia-Pacific region, while the primary attack method is spear-phishing emails that appear to come from government agencies, NGOs, think tanks, or law enforcement. The threat group was previously seen in attacks targeting governments worldwide using Google Drive for malware distribution, custom evasive backdoors, and a worm-based attack chain. The emails spotted by Trend Micro contain a malicious attachment containing the dropper file (IRSetup.exe), a Setup Factory installer. If executed by the victim, it will drop multiple files into C:\ProgramData\session, including legitimate files, the malware components, and a decoy PDF to serve as a diversion. When ESET antivirus products are detected (ekrn.exe or egui.exe) on a compromised machine, Mustang Panda employs a unique evasion mechanism exploiting tools pre-installed on Windows 10 and later. The abuse starts with the Microsoft Application Virtualization I...