Threat actors have begun to distribute malware through a new campaign tracked as the “SmugX” campaign. While there is no confirmed threat organization associated to these attacks, certain indicators of compromise show traces to a command-and-control (C2) server utilized by RedDelta/Mustang Panda, which are well-established threat organizations operating on behalf of the Chinese state. A technique associated with this campaign includes compromising a user or computer network through a technique known as HTML smuggling, which is when malicious code is embedded within HTML documents. Since the code is buried within HTML documents, most anti-virus and security detection software won’t immediately flag the malware as suspicious. Through the use of themed lures surrounding European domestic and foreign policies, threat actors focused on exploiting those involved with governmental ministries throughout Eastern Europe. Once opened by the user, the embedded HTML code will begin to fetch the payload and download it to the associated system. The core malware that is deployed in this campaign is known as “PlugX”, which is a remote access tool (RAT) used by threat groups like RedDelta/Mustang Panda to initiate file exfiltration, screen captures, keylogging, command execution, and further malware deployment on the compromised system. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.