CANONSTAGER
- ID
- S1237
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 23 Oct 2025
CANONSTAGER is a loader known to be leveraged by Mustang Panda and was first observed utilized in 2025. Mustang Panda utilizes DLL side-loading to execute within the victim environment prior to delivering a follow-on malicious encrypted payload. CANONSTAGER leverages Thread Local Storage (TLS) and Native Windows APIs within the victim environment to elude detections. CANONSTAGER also hides its code utilizing window procedures and message queues.[1]
Techniques used (6)
- T1027.007 Dynamic API Resolution
- T1036.005 Match Legitimate Resource Name or Location
- T1055.005 Thread Local Storage
- T1106 Native API
- T1564.003 Hidden Window
- T1574.001 DLL