Back Scworld

Mustang Panda's updated ToneShell backdoor deployed via kernel-mode rootkit

Scworld • December 30, 2025

Attacks leveraging a kernel-mode rootkit to spread a new variant of the ToneShell malware have been launched by Chinese advanced persistent threat ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender. 5 sources 51

Extracted Entities

Mustang Panda's updated ToneShell backdoor deployed via kernel-mode rootkit

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)