CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Mustang Panda, a China-aligned threat actor, has been observed using an updated version of the TONESHELL backdoor and a new USB worm called SnakeDisk. The worm targets devices with Thailand-based IP addresses and delivers the Yokai backdoor. The threat actor, tracked as Hive0154, has been active since at least 2012 and is known for sophisticated cyber operations. The updated TONESHELL variants, TONESHELL8 and TONESHELL9, support C2 communication through proxy servers and incorporate junk code to evade detection. SnakeDisk, which shares similarities with TONEDISK, propagates via USB devices and drops the Yokai backdoor on targeted systems. The Yokai backdoor establishes a reverse shell to execute arbitrary commands. This activity highlights Mustang Panda's continued evolution and focus on specific geographic targets, particularly Thailand.

Timeline

  1. 15.09.2025 21:45 📰 1 articles · ⏱ 1h ago

    Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs

    Mustang Panda, a China-aligned threat actor, has been observed using an updated version of the TONESHELL backdoor and a new USB worm called SnakeDisk. The worm targets devices with Thailand-based IP addresses and delivers the Yokai backdoor. The updated TONESHELL variants, TONESHELL8 and TONESHELL9, support C2 communication through proxy servers and incorporate junk code to evade detection. SnakeDisk propagates via USB devices and drops the Yokai backdoor, which establishes a reverse shell to execute arbitrary commands.

    Show sources
    Open in new tab

Information Snippets