H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

CLAIMLOADER

[CLAIMLOADER](https://attack.mitre.org/software/S1236) is a malware variant that frequently accompanies legitimate executables that are used for DLL side-loading known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2021.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[CLAIMLOADER](https://attack.mitre.org/software/S1236) is a malware variant that frequently accompanies legitimate executables that are used for DLL side-loading known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2021.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)

Labels

malware
12 recorded

Relationships

uses
to Component Object Model
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Dynamic API Resolution
Technique
uses
to Hidden Files and Directories
Technique
uses
to Malicious File
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Mutual Exclusion
Technique
uses
to Native API
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Scheduled Task
Technique
uses
from Mustang Panda
Group
3 external

References

mitre-attack
S1236
open
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025
https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor
open
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA
https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance