Chinese Hackers Deploy Rootkit to Conceal ToneShell Malware in Southeast Asia
Article Content
Browse articles 
A Chinese-linked threat group, associated with HoneyMyte, is utilizing a new kernel rootkit to obscure its ToneShell backdoor. This cyber campaign has primarily targeted government networks in Southeast and East Asia, with significant effects noted in Myanmar and Thailand, focusing on long-term espionage rather than immediate financial gain.
Ask AI about this cluster
Answers cite the sources they use
Updated 241d ago How this analysis works
More articles in this cluster (3)
Following this threat?
Track Bronze President and ToneShell in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
BRONZE SANDCASTLE Exploits DLL Sideloading for Cyber Attacks The BRONZE SANDCASTLE threat group, aligned with China, has been targeting organizations in Asia and Africa since mid-2025 using DLL sideloading techniques. This group employs modified Meterpreter shells, utilizing legitimate applications like Sandboxie to load malicious DLLs, notably 'sbiedll.dll'. The attacks have… 
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…