Camaro Dragon — Threat Actor Profile, Campaigns & Targets

Overview

Camaro Dragon is an Advanced Persistent Threat (APT) group engaged in covert cyber-espionage campaigns. The latest reporting highlights kernel-level intrusion techniques—specifically Mustang Panda deploying ToneShell via a signed kernel—demonstrating high-skill capability, stealth, and persistence that align with Camaro Dragon's threat profile.

Related Threat Clusters

• Chinese APT Targets Qatar Amid Middle East Conflict Using PlugX

  A Chinese advanced persistent threat group, Camaro Dragon, launched a cyberespionage campaign against entities in Qatar on March 2, 2026, following the outbreak of new hostilities in the Middle East. The group utilized…

  3 articles · Updated March 10, 2026
• Mustang Panda Deploys ToneShell Backdoor via Signed Kernel-Mode Rootkit

  In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East…

  5 articles · Updated December 30, 2025

Recent Intelligence Reports

• Chinese APT Campaign Targets Qatar With PlugX Lures Tied to Middle East Conflict — Cybersecuritynews · March 10, 2026
• Mustang Panda deploys ToneShell via signed kernel — Securityaffairs.Co · December 30, 2025

Related Entities