HoneyMyte (aka Mustang Panda) Deploys ToneShell Backdoor in New Attacks

Back Feeds.Feedburner

HoneyMyte (aka Mustang Panda) Deploys ToneShell Backdoor in New Attacks

Feeds.Feedburner •Deeba Ahmed • December 30, 2025

Share: View original

HoneyMyte (Mustang Panda) is back with a new ToneShell backdoor. Read how this stealthy attack blinds Microsoft Defender to target government entities in Asia.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender. 5 sources 51

Extracted Entities

APT Groups (2)

HoneyMyte Mustang Panda

Attack Types (1)

Industries (1)

Malware (1)

Platforms (1)

Microsoft Defender