Mustang Panda Deploys Signed Windows Rootkit in Updated CoolClient Backdoor
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
Tag: Toneshell
Mustang Panda Abuses Zoho WorkDrive as Command Channel in Indian Government Attacks
The China-aligned espionage group Mustang Panda is running two campaigns against Indian government and hydropower targets, deploying new malware and turning a…
MINIRECON: Toneshell Variant Backdoor
MINIRECON is a reworked variant of the Toneshell backdoor, beaconing over WebSocket on HTTPS, used by Mustang Panda.
ToneShell Backdoor
ToneShell is a backdoor used by Mustang Panda, previously associated with a kernel-mode rootkit disclosed in December 2025. It is used for…