IBM X-Force has published a technical report on SnakeDisk, a USB worm linked to Hive0154, a Chinese cyber-espionage group also known as Mustang Panda
www.ibm.com/think/x-forc...
www.ibm.com/think/x-forc...
Hive0154, aka Mustang Panda, drops updated Toneshell backdoor and novel SnakeDisk USB worm | IBM
Hive0154 wreaks havoc on Singapore and Thailand using a new Toneshell backdoor and SnakeDisk USB worm.
www.ibm.com
September 16, 2025 at 9:02 AM
IBM X-Force has published a technical report on SnakeDisk, a USB worm linked to Hive0154, a Chinese cyber-espionage group also known as Mustang Panda
www.ibm.com/think/x-forc...
www.ibm.com/think/x-forc...
ZScaler dropping 2 #MustangPanda blogs
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
Mustang Panda: ToneShell and StarProxy | ThreatLabz
In Part 1 of this series, we explore Mustang Panda’s latest tools: ToneShell & StarProxy, which provide features including remote access and lateral movement.
www.zscaler.com
April 16, 2025 at 5:13 PM
ZScaler dropping 2 #MustangPanda blogs
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.
Chinese state hackers use rootkit to hide ToneShell malware activity
A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.
www.bleepingcomputer.com
December 30, 2025 at 12:08 AM
A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit: The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor." via Security Week www.securityweek.com/chinese-apt-...
Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
The China-linked Mustang Panda APT has been using a kernel-mode rootkit in attacks leading to ToneShell backdoor deployments.
www.securityweek.com
December 30, 2025 at 7:18 PM
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit: The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor." via Security Week www.securityweek.com/chinese-apt-...
China-backed hackers are deploying TONESHELL v3, StarProxy, and stealth tools like SplatCloak to breach Myanmar targets—dodging EDR, logging keystrokes, and hopping across networks with FakeTLS tricks.
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
Mustang Panda uses StarProxy, SplatCloak, and updated TONESHELL to breach Myanmar target undetected.
thehackernews.com
April 18, 2025 at 2:12 AM
China-backed hackers are deploying TONESHELL v3, StarProxy, and stealth tools like SplatCloak to breach Myanmar targets—dodging EDR, logging keystrokes, and hopping across networks with FakeTLS tricks.
• 3 TONESHELL variants
• 2 new keyloggers (PAKLOG, CorKLOG)
• StarProxy – a lateral movement proxy over FakeTLS
• SplatCloak – a Windows kernel-level EDR evasion driver
#Cybersecurity
thehackernews.com/2025/04/must...
• 2 new keyloggers (PAKLOG, CorKLOG)
• StarProxy – a lateral movement proxy over FakeTLS
• SplatCloak – a Windows kernel-level EDR evasion driver
#Cybersecurity
thehackernews.com/2025/04/must...
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
Mustang Panda uses StarProxy, SplatCloak, and updated TONESHELL to breach Myanmar target undetected.
thehackernews.com
April 18, 2025 at 2:12 AM
• 3 TONESHELL variants
• 2 new keyloggers (PAKLOG, CorKLOG)
• StarProxy – a lateral movement proxy over FakeTLS
• SplatCloak – a Windows kernel-level EDR evasion driver
#Cybersecurity
thehackernews.com/2025/04/must...
• 2 new keyloggers (PAKLOG, CorKLOG)
• StarProxy – a lateral movement proxy over FakeTLS
• SplatCloak – a Windows kernel-level EDR evasion driver
#Cybersecurity
thehackernews.com/2025/04/must...
China's Mustang Panda used MAVInject.exe to inject TONESHELL malware (via IRSetup.exe & decoy PDF) into waitfor.exe, bypassing ESET. The Thailand-targeting attack communicated with militarytc[.]com:443.#MustangPandaMAVInject
February 18, 2025 at 4:06 PM
China's Mustang Panda used MAVInject.exe to inject TONESHELL malware (via IRSetup.exe & decoy PDF) into waitfor.exe, bypassing ESET. The Thailand-targeting attack communicated with militarytc[.]com:443.#MustangPandaMAVInject
Mustang Panda Attacking Windows Users With ToneShell Malware Mimic as Google Chrome
Mustang Panda Attacking Windows Users With ToneShell Malware Mimic as Google Chrome
cybersecuritynews.com
August 6, 2025 at 4:08 PM
Mustang Panda Attacking Windows Users With ToneShell Malware Mimic as Google Chrome
Chinese hackers (Mustang Panda) use ToneShell & StarProxy to bypass EDR, masking malicious traffic via FakeTLS. Targeting East Asian government/military, IOCs (MD5s, network indicators) are available.#MustangPandaFakeTLSAttack
April 17, 2025 at 2:09 PM
Chinese hackers (Mustang Panda) use ToneShell & StarProxy to bypass EDR, masking malicious traffic via FakeTLS. Targeting East Asian government/military, IOCs (MD5s, network indicators) are available.#MustangPandaFakeTLSAttack
Excellent write up from folks over at ZScaler for #MustangPanda related activities. Per usual, the group's focused attacks and TOnePipeShell/TOneShell usage continues, alongside custom tools and an EDR blocker designed specifically to target Microsoft/Kaspersky EDRs. also a lil cameo from me
April 18, 2025 at 4:54 AM
Excellent write up from folks over at ZScaler for #MustangPanda related activities. Per usual, the group's focused attacks and TOnePipeShell/TOneShell usage continues, alongside custom tools and an EDR blocker designed specifically to target Microsoft/Kaspersky EDRs. also a lil cameo from me
The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group targeting government organizations in Southeast and East Asia, primarily Myanmar and Thailand. thehackernews.com/2025/12/must...
Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor
Mustang Panda deployed TONESHELL via a signed kernel-mode rootkit, targeting Asian government networks and evading security tools.
thehackernews.com
December 30, 2025 at 1:29 PM
The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group targeting government organizations in Southeast and East Asia, primarily Myanmar and Thailand. thehackernews.com/2025/12/must...
Chinese state hackers use rootkit to hide ToneShell malware activity
Chinese state hackers use rootkit to hide ToneShell malware activity
A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.
www.bleepingcomputer.com
December 30, 2025 at 12:20 AM
Chinese state hackers use rootkit to hide ToneShell malware activity
New ToneShell Backdoor With New Features Leverage Task Scheduler COM Service for Persistence
cybersecuritynews.com/new-toneshel...
#Infosec #Security #Cybersecurity #CeptBiro #ToneShell #Backdoor #NewFeatures #TaskScheduler #COMService #Persistence
cybersecuritynews.com/new-toneshel...
#Infosec #Security #Cybersecurity #CeptBiro #ToneShell #Backdoor #NewFeatures #TaskScheduler #COMService #Persistence
New ToneShell Backdoor With New Features Leverage Task Scheduler COM Service for Persistence
Since its first appearance earlier this year, the ToneShell backdoor has demonstrated a remarkable capacity for adaptation, toyed with by the Mustang Panda group to maintain an enduring foothold in ta...
cybersecuritynews.com
September 12, 2025 at 8:53 PM
New ToneShell Backdoor With New Features Leverage Task Scheduler COM Service for Persistence
cybersecuritynews.com/new-toneshel...
#Infosec #Security #Cybersecurity #CeptBiro #ToneShell #Backdoor #NewFeatures #TaskScheduler #COMService #Persistence
cybersecuritynews.com/new-toneshel...
#Infosec #Security #Cybersecurity #CeptBiro #ToneShell #Backdoor #NewFeatures #TaskScheduler #COMService #Persistence
Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems gbhackers.com/mustang-pand...
Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems
IBM X-Force researchers have uncovered sophisticated new malware campaigns orchestrated by the China-aligned threat actor Hive0154.
gbhackers.com
September 14, 2025 at 11:27 AM
Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems gbhackers.com/mustang-pand...
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor #malware
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
0 views
Eyal Estrin
unread,
12:02 PM (24 minutes ago)
to
https://securelist.com/honeymyte-kernel-mode-rootkit/118590/
Eyal Estrin
CISSP, CCSP, CISM, CISA, CDPSE, CCSK
Blog: https://security-24-7.com | Books: https://amzn.to/42Xai9A | https://amzn.to/3Sggbtv
Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social
Reply all
Reply to author
Forward
groups.google.com
January 1, 2026 at 5:26 PM
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor #malware
Intezer analyses a new ToneShell backdoor variant linked to Mustang Panda. It’s delivered via DLL sideloading with signed EXEs and cloud-hosted lures in ongoing operations against Myanmar. intezer.com/blog/franken...
September 12, 2025 at 10:40 AM
Intezer analyses a new ToneShell backdoor variant linked to Mustang Panda. It’s delivered via DLL sideloading with signed EXEs and cloud-hosted lures in ongoing operations against Myanmar. intezer.com/blog/franken...
Notícia da SecurityWeek
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit" #bolhasec
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit" #bolhasec
Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
The China-linked Mustang Panda APT has been using a kernel-mode rootkit in attacks leading to ToneShell backdoor deployments.
www.securityweek.com
February 18, 2026 at 12:30 PM
Notícia da SecurityWeek
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit" #bolhasec
"Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit" #bolhasec