Mustang Panda ToneShell kernel-mode loader campaign against Asian government organizations
Campaign
Summary
Hide ▲
Show ▼
A Mustang Panda campaign is using ToneShell delivered through a kernel-mode loader to hide malicious activity from security tools while targeting government organizations across Asia. The operation has been active since at least February 2025 and has been seen in Myanmar, Thailand, and other Asian countries. The loader and rootkit-style controls increase the group’s stealth and resilience. The campaign matters because it combines espionage targeting with malware delivery designed to evade detection.
Related Happenings
Webworm multi-country targeting campaign against government and enterprise victims
Campaign
First: 20.05.2026 15:51
Last: 20.05.2026 15:51
Sources 1
About this happening:
**Webworm** is running a **multi-country targeting campaign** against **government agencies and enterprises**, expanding the risk of persistent access across several regions. The...
Webworm multi-country targeting campaign against government and enterprise victims
CampaignAbout this happening: **Webworm** is running a **multi-country targeting campaign** against **government agencies and enterprises**, expanding the risk of persistent access across several regions. The...
Mustang Panda Asia-Pacific and Japan CDN impersonation espionage campaign
Campaign
First: 14.05.2026 18:00
Last: 14.05.2026 18:00
Sources 1
About this happening:
A **Mustang Panda** espionage campaign used **CDN impersonation** and **DLL sideloading** to target **Asia-Pacific and Japan** networks, extending from **late September 2025 throu...
Mustang Panda Asia-Pacific and Japan CDN impersonation espionage campaign
CampaignAbout this happening: A **Mustang Panda** espionage campaign used **CDN impersonation** and **DLL sideloading** to target **Asia-Pacific and Japan** networks, extending from **late September 2025 throu...
LotusLite backdoor delivered via DLL sideloading
Malware Activity
First: 21.04.2026 15:00
Last: 21.04.2026 15:00
Sources 1
About this happening:
The **LotusLite** backdoor is being delivered through **malicious files** and **DLL sideloading**, creating a remote-access malware activity that supports **espionage**. The opera...
LotusLite backdoor delivered via DLL sideloading
Malware ActivityAbout this happening: The **LotusLite** backdoor is being delivered through **malicious files** and **DLL sideloading**, creating a remote-access malware activity that supports **espionage**. The opera...
Mustang Panda, CL-STA-1048, and CL-STA-1049 Southeast Asia government campaign
Campaign
First: 30.03.2026 10:00
Last: 30.03.2026 10:00
Sources 1
About this happening:
Three **China-aligned** clusters targeted a **government organization in Southeast Asia**, signaling a **coordinated campaign** built for long-term access. The activity spans **Mu...
Mustang Panda, CL-STA-1048, and CL-STA-1049 Southeast Asia government campaign
CampaignAbout this happening: Three **China-aligned** clusters targeted a **government organization in Southeast Asia**, signaling a **coordinated campaign** built for long-term access. The activity spans **Mu...
Amaranth-Dragon Southeast Asia espionage campaign
Campaign
First: 04.02.2026 16:09
Last: 04.02.2026 16:09
Sources 1
About this happening:
The **Amaranth-Dragon** espionage campaign targeted **government and law enforcement agencies** across **Southeast Asia** throughout **2025**, indicating a sustained effort to est...
Amaranth-Dragon Southeast Asia espionage campaign
CampaignAbout this happening: The **Amaranth-Dragon** espionage campaign targeted **government and law enforcement agencies** across **Southeast Asia** throughout **2025**, indicating a sustained effort to est...
Timeline
-
30.12.2025 02:08 2 articles · 4mo ago
Kaspersky discloses Mustang Panda ToneShell rootkit delivery
Initial DisclosureKaspersky disclosed a new ToneShell backdoor sample attributed with high confidence to Mustang Panda, also known as HoneyMyte or Bronze President, and said the malware was being delivered through the kernel-mode loader ProjectConfiguration.sys in attacks against government organizations in Myanmar, Thailand, and other Asian countries. The analysis described stolen-or-leaked signing material issued to Guangzhou Kingteller Technology Co., Ltd., fake TLS headers, a 4-byte host ID scheme, file-system and registry interception, and interference with Microsoft Defender through WdFilter.
Show sources
- Chinese state hackers use rootkit to hide ToneShell malware activity — www.bleepingcomputer.com — 30.12.2025 02:08
- Chinese state hackers use rootkit to hide ToneShell malware activity — www.bleepingcomputer.com — 30.12.2025 02:08