Mustang Panda deploys ToneShell via signed kernel

Securityaffairs.Co •Pierluigi Paganini • December 30, 2025

China-linked APT Mustang Panda used a signed kernel-mode rootkit driver to load shellcode and deploy its ToneShell backdoor. China-linked APT Mustang Panda (aka Hive0154, HoneyMyte, Camaro Dragon, RedDelta or Bronze President) was observed using a signed kernel-mode rootkit driver with embedded shellcode to deploy its ToneShell backdoor. Mustang Panda has been active since at least 2012, targeting American and European entities such as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender. 5 sources 51

Extracted Entities

Mustang Panda deploys ToneShell via signed kernel

The full story

Extracted Entities

APT Groups (6)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)