ToneShell is a backdoor malware attributed to Mustang Panda (also called HoneyMyte) that is deployed through kernel-mode rootkits and signed drivers to achieve kernel-level persistence and stealth on Windows.
ToneShell is a backdoor malware attributed to Mustang Panda (also called HoneyMyte) that is deployed through kernel-mode rootkits and signed drivers to achieve kernel-level persistence and stealth on Windows. The use of signed components and rootkit techniques indicates advanced evasion capabilities, making ToneShell a notable concern for Windows security and state-sponsored operations.
In June 2026, Mustang Panda launched two espionage campaigns targeting India's hydropower sector and government entities. The attacks utilized lure documents related to cooperation agreements with Taiwan, delivering…
The Mustang Panda group has intensified its cyber-espionage efforts by deploying a new variant of the CoolClient backdoor, which includes advanced infostealer capabilities. This updated malware targets government and…
The HoneyMyte APT group has developed a new cyberespionage campaign utilizing a malicious kernel-mode driver to deploy the ToneShell backdoor. This driver, signed with a stolen digital certificate, operates as a rootkit…
In mid-2025, the Chinese APT group Mustang Panda launched cyber-espionage attacks using a signed kernel-mode rootkit to deploy the ToneShell backdoor. The attacks targeted government organizations in Southeast and East…
A Chinese-linked threat group, associated with HoneyMyte, is utilizing a new kernel rootkit to obscure its ToneShell backdoor. This cyber campaign has primarily targeted government networks in Southeast and East Asia,…
HoneyMyte, also known as Mustang Panda or Bronze President, has been active in espionage campaigns targeting government entities in Asia and Europe, particularly Southeast Asia. The group has deployed multiple…
The Chinese-linked group Mustang Panda has utilized a kernel-level rootkit to implant undetectable TONESHELL malware in Windows systems. This attack primarily targets Southeast Asian nations, indicating a strategic…