Mustang Panda Targets India’s Government and Energy Sectors With ZOHOMURK and MINIRECON

Gbhackers •Mayura Kathir • June 30, 2026

Two concurrent espionage campaigns by Mustang Panda targeting Indian government and energy-sector organisations, deploying a novel malware suite that includes SHARDLOADER, MINIRECON and ZOHOMURK. The intrusions, observed in June 2026, focused on hydropower entities and government offices engaged in MOUs with Taiwanese institutions, using geopolitically themed lures and weaponised archives that sideload malicious DLLs via […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Espionage Campaigns Target India's Government and Energy Sectors In June 2026, Mustang Panda launched two espionage campaigns targeting India's hydropower sector and government entities. The attacks utilized lure documents related to cooperation agreements with Taiwan, delivering malware including SHARDLOADER, MINIRECON, and ZOHOMURK. These campaigns employed DLL-based loaders and weaponized archives to sideload malicious components. The threat actor demonstrated knowledge of India's software compliance landscape, indicating a sophisticated approach. Both campaigns shared similar tools and techniques, suggesting a moderate retooling effort while maintaining a focus on Indian targets. Acronis has attributed these activities to Mustang Panda, a group linked to China, based on deployment patterns and operational characteristics. The ongoing threat highlights the persistent interest of state-aligned actors in India's critical infrastructure. 2 sources 73

Extracted Entities

Mustang Panda Targets India’s Government and Energy Sectors With ZOHOMURK and MINIRECON

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (2)

Malware (3)

MITRE ATT&CK (1)