Back Thehackernews

Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

Thehackernews •[email protected] (The Hacker News) • June 29, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Exploits Zoho WorkDrive in Attacks on Indian Government Mustang Panda, a China-aligned cyber espionage group, is conducting dual attack campaigns targeting Indian government and energy sectors. They are utilizing Zoho WorkDrive as a command center, employing newly developed malware tools to exfiltrate sensitive data while camouflaging malicious traffic as legitimate cloud activity. The scope of the attacks is significant, affecting critical infrastructure and government operations. The group has been linked to previous cyber espionage activities, indicating a sustained effort to gather intelligence on Indian operations. Current status shows ongoing investigations and heightened security measures in response to these attacks. 3 sources 75

Extracted Entities

Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

The full story

Extracted Entities

APT Groups (1)

Companies (1)

Industries (1)

MITRE ATT&CK (1)

Tools (1)