Scworld Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit
Article Content
Browse articles 
In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender.
Ask AI about this cluster
Answers cite the sources they use
Updated 242d ago How this analysis works
More articles in this cluster (5)
Following this threat?
Track Bronze President, ToneShell and CVE-2025-20393 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
BRONZE SANDCASTLE Exploits DLL Sideloading for Cyber Attacks The BRONZE SANDCASTLE threat group, aligned with China, has been targeting organizations in Asia and Africa since mid-2025 using DLL sideloading techniques. This group employs modified Meterpreter shells, utilizing legitimate applications like Sandboxie to load malicious DLLs, notably 'sbiedll.dll'. The attacks have… 
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…