CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Mustang Panda targets Thailand with Yokai backdoor via SnakeDisk USB worm

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Mustang Panda, a China-aligned threat actor, has deployed an updated version of the TONESHELL backdoor and a new USB worm called SnakeDisk. The worm targets devices with Thailand-based IP addresses to deliver the Yokai backdoor. Mustang Panda, also known as Hive0154, has been active since at least 2012 and is known for its sophisticated attack chains involving spear-phishing and multiple malware families. The Yokai backdoor sets up a reverse shell to execute arbitrary commands. The new TONESHELL variants, TONESHELL8 and TONESHELL9, use locally configured proxy servers for C2 communication and incorporate junk code to evade detection. SnakeDisk propagates via USB devices and is geofenced to execute only in Thailand. The use of SnakeDisk and Yokai indicates a sub-group within Mustang Panda focused on Thailand.

Timeline

  1. 15.09.2025 21:45 1 articles · 14d ago

    Mustang Panda deploys SnakeDisk USB worm to deliver Yokai backdoor on Thailand IPs

    Mustang Panda, also known as Hive0154, has been observed using an updated version of the TONESHELL backdoor and a new USB worm called SnakeDisk. The worm targets devices with Thailand-based IP addresses to deliver the Yokai backdoor. The new TONESHELL variants, TONESHELL8 and TONESHELL9, use locally configured proxy servers for C2 communication and incorporate junk code to evade detection. SnakeDisk propagates via USB devices and is geofenced to execute only in Thailand.

    Show sources
    Open in new tab

Information Snippets