Mustang Panda’s Hive0154 uses SnakeDisk USB worm to drop Yokai backdoor on Thailand IPs, expanding malware ecosystem.

Hive0154 wreaks havoc on Singapore and Thailand using a new Toneshell backdoor and SnakeDisk USB worm.

Im Juli 2025 entdeckte IBM X-Force neue Malware, die dem mit China verbundenen Bedrohungsakteur Hive0154 zugeschrieben wird. Dazu zählen eine aktualisierte Variante der Toneshell-Backdoor, die Erkennu...

Mustang Panda’s Hive0154 uses SnakeDisk USB worm to drop Yokai backdoor on Thailand IPs, expanding malware ecosystem.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter SmokeLoader Rises From the Ashes  Hive0154, aka Mustang Panda, drops updated Toneshell backdoor and novel SnakeDisk USB worm Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages  Self-replicating Shai-hulud worm spreads […]

China-linked APT group Mustang Panda has been spotted using a new USB worm called SnakeDisk along with a new version of known malware China-linked APT group Mustang Panda (aka Hive0154, Camaro Dragon, RedDelta or Bronze President) has been spotted using an updated version of the TONESHELL backdoor and a previously undocumented USB worm called SnakeDisk. Mustang Panda has been active since […]

The China-aligned threat actor known as Mustang Panda has been observed using an updated version of a backdoor called TONESHELL and a previously undocumented USB worm called SnakeDisk. "The worm only executes on devices with Thailand-based IP addresses and drops the Yokai backdoor," IBM X-Force researchers Golo Mühr and Joshua Chung said in an analysis published last week. The tech giant's

SnakeDisk USB Worm - IBM X-Force has uncovered advanced espionage operations by Hive0154, a China-aligned threat group also tracked.

IBM X-Force researchers have uncovered sophisticated new malware campaigns orchestrated by the China-aligned threat actor Hive0154.

中国系APTグループMustang Panda（Hive0154）がタイ限定のサイバー攻撃を実行。USBワーム「SnakeDisk」とバックドア「Yokai」、TONESHELL最新版を駆使した高度な攻撃手法をIBM X-Forceが報告。ChatGPTコードを悪用した検知回避技術や地政学的背景も含めて詳細解説します。

China-linked APT group Mustang Panda has been spotted using a new USB worm called SnakeDisk along with new version of known malware

Hive0154 wreaks havoc on Singapore and Thailand using a new Toneshell backdoor and SnakeDisk USB worm.

Mustang Panda’s Hive0154 uses SnakeDisk USB worm to drop Yokai backdoor on Thailand IPs, expanding malware ecosystem.