Technadu

HoneyMyte APT Campaign Deploys ToneShell via Kernel-Mode Rootkit

First seen 29 Dec 2025, 18:23 UTC • Securelist

•80% similarity •53.7

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The HoneyMyte APT group has developed a new cyberespionage campaign utilizing a malicious kernel-mode driver to deploy the ToneShell backdoor. This driver, signed with a stolen digital certificate, operates as a rootkit to hide the attacker's presence and injects the backdoor into system processes.

ThreatCluster AI

Attack Flow

16 entities, 56 inferred relationships (STIX 2.1).

Threat Actor (4)

Bronze President
Evasive Panda
HoneyMyte
Mustang Panda

Technique (3)

Malware
Trojan
Worm

Campaign (2)

Evasive Panda APT Cyberespionage Campaign
HoneyMyte APT Campaign

Malware (4)

MgBot
PlugX
ToneDisk
ToneShell

Indicator (3)

36f121046192b7cac3e4bec491e8f1b5
abe44ad128f765c14d895ee1c8bad777
fe091e41ba6450bcf6a61a2023fe6c83

Relationships

Bronze President uses MgBot
Bronze President uses PlugX
Bronze President uses ToneDisk
Bronze President uses ToneShell
Evasive Panda uses MgBot
Evasive Panda uses PlugX
Evasive Panda uses ToneDisk
Evasive Panda uses ToneShell
HoneyMyte uses MgBot
HoneyMyte uses PlugX
HoneyMyte uses ToneDisk
HoneyMyte uses ToneShell
Mustang Panda uses MgBot
Mustang Panda uses PlugX
Mustang Panda uses ToneDisk
Mustang Panda uses ToneShell
Bronze President uses Malware
Bronze President uses Trojan
Bronze President uses Worm
Evasive Panda uses Malware
Evasive Panda uses Trojan
Evasive Panda uses Worm
HoneyMyte uses Malware
HoneyMyte uses Trojan
HoneyMyte uses Worm
Mustang Panda uses Malware
Mustang Panda uses Trojan
Mustang Panda uses Worm
MgBot communicates with 36f121046192b7cac3e4bec491e8f1b5
MgBot communicates with abe44ad128f765c14d895ee1c8bad777
MgBot communicates with fe091e41ba6450bcf6a61a2023fe6c83
PlugX communicates with 36f121046192b7cac3e4bec491e8f1b5
PlugX communicates with abe44ad128f765c14d895ee1c8bad777
PlugX communicates with fe091e41ba6450bcf6a61a2023fe6c83
ToneDisk communicates with 36f121046192b7cac3e4bec491e8f1b5
ToneDisk communicates with abe44ad128f765c14d895ee1c8bad777
ToneDisk communicates with fe091e41ba6450bcf6a61a2023fe6c83
ToneShell communicates with 36f121046192b7cac3e4bec491e8f1b5
ToneShell communicates with abe44ad128f765c14d895ee1c8bad777
ToneShell communicates with fe091e41ba6450bcf6a61a2023fe6c83
Evasive Panda APT Cyberespionage Campaign attributed to Bronze President
Evasive Panda APT Cyberespionage Campaign attributed to Evasive Panda
Evasive Panda APT Cyberespionage Campaign attributed to HoneyMyte
Evasive Panda APT Cyberespionage Campaign attributed to Mustang Panda
HoneyMyte APT Campaign attributed to Bronze President
HoneyMyte APT Campaign attributed to Evasive Panda
HoneyMyte APT Campaign attributed to HoneyMyte
HoneyMyte APT Campaign attributed to Mustang Panda
Evasive Panda APT Cyberespionage Campaign uses MgBot
Evasive Panda APT Cyberespionage Campaign uses PlugX
Evasive Panda APT Cyberespionage Campaign uses ToneDisk
Evasive Panda APT Cyberespionage Campaign uses ToneShell
HoneyMyte APT Campaign uses MgBot
HoneyMyte APT Campaign uses PlugX
HoneyMyte APT Campaign uses ToneDisk
HoneyMyte APT Campaign uses ToneShell

Community

Browse all →

HoneyMyte APT Campaign Deploys ToneShell via Kernel-Mode Rootkit

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading