PUBLOAD and Pubshell Malware Used in Mustang Panda’s Tibet-Specific Attack
A new cyber espionage effort targeting the Tibetan community has been traced to Mustang Panda, a threat actor with ties to China.
According to IBM X-Force, the spear-phishing attempts took advantage of Tibet-related subjects such the 9th World Parliamentarians' Convention on Tibet (WPCT), China's educational policies in the Tibet Autonomous Region (TAR), and a newly released book by the 14th Dalai Lama.
The technology company's cybersecurity branch reported that it had seen the effort earlier this month, which resulted in the deployment of PUBLOAD, a known Mustang Panda virus. The threat actor, Hive0154, is being tracked by it.
In addition to articles replicated by Tibetan websites and images from WPCT, the attack chains use Tibet-themed lures to spread a malicious archive read m...