Scworld

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit

First seen 30 Dec 2025, 19:25 UTC • Youtube

•80% similarity •50.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East Asia, including Myanmar and Thailand, and utilized advanced techniques to evade detection by security software like Microsoft Defender.

ThreatCluster AI

Attack Flow

11 entities, 20 inferred relationships (STIX 2.1).

Threat Actor (6)

Bronze President
Camaro Dragon
Hive0154
HoneyMyte
Mustang Panda
RedDelta

Technique (2)

Malware
T1014 - Rootkit

Vulnerability (1)

CVE-2025-20393

Malware (1)

ToneShell

Affected Platform (1)

Microsoft Defender

Relationships

Bronze President uses ToneShell
Camaro Dragon uses ToneShell
Hive0154 uses ToneShell
HoneyMyte uses ToneShell
Mustang Panda uses ToneShell
RedDelta uses ToneShell
Bronze President uses Malware
Bronze President uses T1014 - Rootkit
Camaro Dragon uses Malware
Camaro Dragon uses T1014 - Rootkit
Hive0154 uses Malware
Hive0154 uses T1014 - Rootkit
HoneyMyte uses Malware
HoneyMyte uses T1014 - Rootkit
Mustang Panda uses Malware
Mustang Panda uses T1014 - Rootkit
RedDelta uses Malware
RedDelta uses T1014 - Rootkit
ToneShell exploits CVE-2025-20393
CVE-2025-20393 targets Microsoft Defender

Community

Browse all →

Tracked Entities in This Story

Bronze President Camaro Dragon Hive0154 HoneyMyte Mustang Panda RedDelta ToneShell Microsoft Defender Government Malware

Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story