Mustang Panda Abuses Zoho WorkDrive for Command-and

Cybersecuritynews •Tushar Subhra Dutta • June 30, 2026

A China-aligned cyber espionage group known as Mustang Panda has been caught running two simultaneous attack campaigns against Indian government and energy targets, using a trusted cloud storage service as its hidden command center. The group deployed newly developed malware tools to silently steal data while making malicious traffic blend in with normal cloud activity. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Exploits Zoho WorkDrive in Attacks on Indian Government Mustang Panda, a China-aligned cyber espionage group, is conducting dual attack campaigns targeting Indian government and energy sectors. They are utilizing Zoho WorkDrive as a command center, employing newly developed malware tools to exfiltrate sensitive data while camouflaging malicious traffic as legitimate cloud activity. The scope of the attacks is significant, affecting critical infrastructure and government operations. The group has been linked to previous cyber espionage activities, indicating a sustained effort to gather intelligence on Indian operations. Current status shows ongoing investigations and heightened security measures in response to these attacks. 3 sources 75

Extracted Entities

Mustang Panda Abuses Zoho WorkDrive for Command-and

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (2)

MITRE ATT&CK (2)

Tools (1)