Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender. 5 sources 51