TONESHELL Archives

In a cyberattack discovered in mid-2025 that targeted an unidentified Asian entity, the Chinese hacker collective Mustang Panda used an undocumented kernel-mode rootkit driver to deliver a new backdoor variant known as TONESHELL. Kaspersky conducted cyber espionage efforts against government agencies in Southeast and East Asia, namely Myanmar and Thailand, and discovered the new backdoor variant. According to the Russian cybersecurity firm, the driver file registers as a minifilter driver on compromised computers and is signed with an outdated, stolen, or compromised digital certificate. Its ultimate objective is to safeguard registry keys, user-mode processes, and harmful files by inserting a backdoor trojan into system processes. TONESHELL, an implant with reverse shell and dow...

An new version of the backdoor TONESHELL and a hitherto unreported USB worm dubbed SnakeDisk have been seen being used by the China-aligned threat actor Mustang Panda. In an investigation released last week, IBM X-Force experts Golo Mühr and Joshua Chung stated that the worm only runs on machines with IP addresses based in Thailand and opens the Yokai backdoor. Hive0154, also known as BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, Polaris, RedDelta, Stately Taurus, and Twill Typhoon, is the cluster being tracked by the tech giant's cybersecurity team. Since at least 2012, the state-sponsored threat actor is thought to have been active. Trend Micro initially made TONESHELL public in November 2022 as a component of cyberattacks that targeted Taiwan, Japan, Australi...

Tag: TONESHELL

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs