Mustang Panda Deploys Signed Windows Rootkit in Updated CoolClient Backdoor
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
Tag: Mustang Panda
CoolClient Backdoor Analysis
CoolClient is a modular backdoor used by Mustang Panda. It supports keylogging, clipboard theft, credential harvesting, file management, and system reconnaissance. The…
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Fortinet FortiGuard Labs has disclosed a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool popular among overseas Chinese…
Mustang Panda
[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been…
WhatsApp-to-Host Attack Chain Exploits Three OpenClaw Flaws for Code Execution
Security researcher Chinmohan Nayak has detailed a WhatsApp-to-host attack chain leveraging three now-patched vulnerabilities in the OpenClaw personal AI assistant. The flaws,…
Mustang Panda Abuses Zoho WorkDrive as Command Channel in Indian Government Attacks
The China-aligned espionage group Mustang Panda is running two campaigns against Indian government and hydropower targets, deploying new malware and turning a…
Mustang Panda (HoneyMyte) Threat Actor Profile
Mustang Panda, also known as HoneyMyte, is a China-linked advanced persistent threat (APT) group active since at least 2013. It primarily targets…
SHARDLOADER: DLL Sideloading Malware Loader
SHARDLOADER is a malware loader used by Mustang Panda that sideloads a malicious DLL through legitimately signed binaries like Solid PDF Creator…
MINIRECON: Toneshell Variant Backdoor
MINIRECON is a reworked variant of the Toneshell backdoor, beaconing over WebSocket on HTTPS, used by Mustang Panda.
ZOHOMURK: Zoho WorkDrive Dead Drop Malware
ZOHOMURK is a novel malware that uses hardcoded Zoho OAuth credentials to turn an attacker-controlled WorkDrive account into a dead drop for…