Mustang Panda / TA416
One of China's most prolific and consistently active espionage groups, distinguished by high operational tempo and a "volume over stealth" targeting philosophy. Campaigns are tightly aligned with PRC foreign policy moments — the 2020 Vatican targeting coincided precisely with Sino-Vatican bishop appointment negotiations; the 2022 European government surge tracked the outbreak of war in Ukraine; the 2024 ASEAN-Australia Summit targeting reflected Beijing's South and Southeast Asia priorities. The group does not attempt the years-long undetected persistence of other Chinese APTs — instead it operates at scale, accepting some detection risk in exchange for broad intelligence collection across government, diplomatic, religious, and NGO targets across Asia and Europe.
Overview
Mustang Panda is one of the most extensively tracked Chinese state-sponsored threat actors in the public threat intelligence record — appearing under more than fifteen aliases across vendors, reflecting both the group's persistence and the fragmented nature of attribution across campaigns that span more than a decade. CrowdStrike named the group in 2018 after observing a US think tank intrusion, but subsequent research placed active operations back to at least 2012. Despite the depth of public documentation, the group has continued operating without significant disruption, adapting tooling while maintaining core campaign patterns aligned with PRC foreign policy priorities.
The group's defining characteristic is operational tempo. Unlike the Winnti network's multi-year undetected intrusions, Mustang Panda runs high-volume spearphishing campaigns targeting dozens of organizations simultaneously, accepting that some will be detected quickly. The intelligence collection model appears to favor breadth: sweeping large populations of government officials, diplomats, and NGO personnel within a target region, then extracting documents and communications of intelligence value. This "volume over stealth" approach is attested across numerous vendor reports and is explicitly noted in ThreatConnect's intelligence dashboard characterization of the group.
Historically, PlugX was Mustang Panda's primary tool — a modular RAT used across Chinese APT groups that the group customized extensively over years of operation. In January 2025, a coordinated international law enforcement operation removed PlugX malware from over 4,000 infected computers in the United States, disrupting a significant portion of the group's legacy C2 infrastructure. The group responded with characteristic resilience: ToneShell — a backdoor unique to Mustang Panda — had already been in active use since 2022 and was rapidly advanced with kernel-mode rootkit delivery (documented by Kaspersky in mid-2025) and new variants including Toneshell9. The 2025 SnakeDisk USB worm — IP-gated to execute only on Thailand-based machines — demonstrated both the group's geographic targeting precision and its interest in penetrating air-gapped government networks.
In January 2026, Mustang Panda (operating as the LOTUSLITE cluster) renewed attacks against US government and policy organizations using Venezuela-themed spearphishing emails delivering the LOTUSLITE backdoor — a custom C++ implant communicating with a hard-coded IP-based C2 server. This followed the January 2025 DOJ/FBI PlugX infrastructure disruption and the mid-2025 SnakeDisk and kernel-mode rootkit ToneShell campaigns targeting Southeast Asian governments. The group is assessed as fully operational with a retooled infrastructure as of Q1 2026.
Target Profile
Mustang Panda's targeting follows PRC foreign policy priorities with a consistency that functions as a near-real-time indicator of Chinese intelligence collection interests. Campaign timing against specific entities has tracked geopolitical events within days to weeks of their occurrence.
- Governments and diplomatic missions: The primary target category across all documented Mustang Panda campaigns. Government agencies, foreign ministries, embassies, and diplomatic personnel across Southeast Asia, South Asia, Europe, and beyond are systematically targeted. The 2022 campaign surge against European governments began within days of Russia's invasion of Ukraine, suggesting tasking to collect on European foreign policy decision-making in real time.
- Vatican and Catholic organizations: Documented targeting of the Vatican and Catholic organizations in Hong Kong during 2020 Sino-Vatican negotiations over bishop appointments — the most precise alignment between Mustang Panda campaign timing and a specific PRC foreign policy moment in the public record. Recorded Future's Insikt Group published detailed attribution in July 2020. The targeting reflected Chinese intelligence interest in monitoring the Catholic Church's position on Chinese government-sanctioned church administration.
- ASEAN nations and regional governments: Myanmar, Thailand, the Philippines, Vietnam, Cambodia, Singapore, Indonesia, and Malaysia have all seen documented Mustang Panda targeting. Myanmar is a particularly sustained target — the group's SnakeDisk worm was delivered via a PDF lure impersonating the Myanmar Ministry of Foreign Affairs. The 2024 ASEAN-Australia Summit generated a specific campaign against attendee organizations documented by Unit 42.
- Non-governmental organizations: NGOs focused on Tibetan affairs, Mongolian politics, religious freedom, and human rights are consistent targets. The group's earliest documented activity (CrowdStrike 2017) involved US-based NGOs using Mongolian-language lures. Tibetan community organizations were specifically targeted in a June 2025 IBM X-Force campaign deploying Pubload backdoor.
- Think tanks and research institutions: Policy research organizations in the US and Europe are targeted for intelligence on foreign policy positions, particularly those publishing on Taiwan, Tibet, Hong Kong, and South China Sea issues.
- Telecommunications: Telecom targeting provides access to call records and communications infrastructure, consistent with broader Chinese intelligence collection patterns seeking persistent access to communications metadata across target populations.
- US policy organizations (2026): The January 2026 LOTUSLITE campaign targeted US government and policy organizations — marking renewed direct US targeting following the PlugX infrastructure disruption and demonstrating that law enforcement actions did not degrade the group's operational capacity against high-priority targets.
Tactics, Techniques & Procedures
Mustang Panda's TTPs have evolved substantially from PlugX-heavy phishing operations to a multi-layered toolkit including kernel-mode rootkits, USB worms, and cloud-masked C2 channels — while maintaining the DLL side-loading delivery core that has characterized the group since its earliest documented campaigns.
| mitre id | technique | description |
|---|---|---|
| T1566.001 | Spearphishing — Current Event Lures | Mustang Panda's primary initial access vector. Lures are systematically themed around current events relevant to target populations: COVID-19 documents, Ukrainian conflict briefings, European Commission communications, Myanmar Ministry of Foreign Affairs correspondence, ASEAN Summit agendas, and Vatican-related materials. Fake Google accounts have been used to distribute malicious archives via Google Drive links, lending apparent legitimacy to delivery. |
| T1574.002 | DLL Side-Loading — Core Execution Method | DLL side-loading is the group's defining execution technique across all documented tool generations. A legitimate, signed binary is paired with a malicious DLL that is loaded by the binary's standard DLL search order. This technique abuses the trust granted to the signed binary to execute unsigned malicious code. Applied to PlugX delivery, ToneShell delivery, PAKLOG deployment, and LOTUSLITE installation. The signed binary varies by campaign but is consistently a legitimate application from a known vendor. |
| T1543.003 | Kernel-Mode Rootkit — ToneShell Delivery (2025) | A significant 2025 capability escalation documented by Kaspersky. A malicious kernel driver (ProjectConfiguration.sys) signed with a stolen certificate from Guangzhou Kingteller Technology Co., Ltd. installs as a minifilter driver. It injects a user-mode component into a high-privilege process, then injects the ToneShell backdoor from embedded shellcode entirely in memory — leaving no disk-based payload. The driver protects ToneShell by blocking handle access to the injected process and registering callbacks to deny file deletion and registry modification attempts. It explicitly disables Microsoft Defender's WdFilter driver. |
| T1092 | USB Propagation — SnakeDisk Worm | Discovered in mid-August 2025 by IBM X-Force, SnakeDisk is a 32-bit DLL worm that executes only on systems with Thailand-based IP addresses — a geofencing mechanism that limits activation to the targeted country. Propagates via removable USB storage devices. Drops the Yokai backdoor on qualifying systems. Configuration is protected by a two-phase XOR decryption algorithm with a 320-byte key. The Thailand-only execution is assessed as targeting air-gapped Thai government networks, coinciding with Thailand-Cambodia geopolitical tensions during 2025. |
| T1071.001 | C2 over Raw TCP — FakeTLS (ToneShell) | ToneShell communicates with C2 servers over raw TCP on port 443, masking traffic with fake TLS 1.3 headers and encrypted payloads to blend with HTTPS traffic at the network perimeter. Toneshell9 (documented in 2025) added proxy-aware C2 communication, reading Windows registry proxy settings to route C2 traffic through enterprise proxies and blend with legitimate outbound traffic patterns. |
| T1056.001 | Keylogging — PAKLOG and CorKLOG | Two custom keyloggers documented by Zscaler ThreatLabz in April 2025. PAKLOG captures keystrokes and clipboard data using high-level Windows APIs, encoding output with a custom character scheme. CorKLOG captures keystrokes with 48-character RC4 key encryption on captured logs, with persistence via services or scheduled tasks. Both are deployed via DLL side-loading (typically from a RAR archive). Neither has direct C2 exfiltration — data is collected locally for subsequent exfiltration through other channels. |
| T1562.001 | EDR Evasion — SplatCloak Driver | SplatCloak is a Windows kernel driver deployed by SplatDropper that disables kernel-level notification callbacks registered by four Windows Defender-related drivers and Kaspersky drivers — preventing these security products from receiving OS-level notifications about process creation, file operations, and registry changes. Deployed alongside PAKLOG, CorKLOG, and ToneShell in campaigns where EDR evasion is required before keylogger deployment. |
| T1090.001 | Lateral Movement — StarProxy | StarProxy is an internal network proxy tool that creates encrypted communication channels within segmented networks, enabling lateral movement between isolated network segments without direct external C2 connections. Uses FakeTLS protocol — the same technique as ToneShell — for encrypted internal traffic. Allows Mustang Panda operators to reach hosts that have no direct internet access by routing commands through already-compromised internal machines. |
| T1025 | Data from Removable Media / HIUPAN Worm | The HIUPAN USB worm propagates malware via removable media, documented in campaigns across Vietnam, Cambodia, and the Philippines. Enables stealthy propagation in environments with strong network monitoring but relaxed physical media controls — a common configuration in some Southeast Asian government networks that use air-gap systems for sensitive workloads but still permit USB device use. |
| T1036.005 | Masquerading — Legitimate Service Impersonation | ToneShell creates a marker file at C:\ProgramData\MicrosoftOneDrive.tlb to store a host identifier — deliberately choosing a path resembling a legitimate Microsoft OneDrive component. C2 traffic is disguised to resemble TLS 1.3 HTTPS sessions. LOTUSLITE C2 communicates with a hard-coded IP-based server rather than a domain, avoiding DNS-based detection. Delivery archives have impersonated ASEAN Summit agendas, European Commission reports, and Myanmar foreign ministry documents. |
Known Campaigns
Selected operations across Mustang Panda's documented history, illustrating the tight alignment between campaign timing and PRC foreign policy events, and the group's geographic expansion from APAC to global targeting.
CrowdStrike observed Mustang Panda in April 2017 targeting a US-based think tank using Mongolian-language lures — the group's first public attribution. Subsequent analysis documented a broader campaign against NGOs with a specific focus on organizations publishing on Mongolian, Tibetan, and Hong Kong affairs. The use of Mongolian-language decoys suggested intelligence collection on China-Mongolia relations and Beijing's concerns about Mongolian foreign policy alignment. PlugX delivered via DLL side-loading was the primary malware, with Poison Ivy used in some earlier-phase intrusions.
Recorded Future's Insikt Group published attribution in July 2020 of a RedDelta (Mustang Panda) campaign targeting the Vatican and Catholic Church organizations, including the Hong Kong Study Mission to China and the Pontifical Institute for Foreign Missions. The timing was precise: targeting began shortly before a scheduled renewal of the 2018 Sino-Vatican agreement on bishop appointments — a diplomatic process in which the Vatican's intelligence on PRC positions, and PRC intelligence on the Vatican's negotiating posture, were directly relevant to ongoing negotiations. Catholic-themed lures were used, with PlugX delivered via DLL side-loading. This campaign represents the clearest documented example of Mustang Panda campaign timing tracking a specific PRC foreign policy event.
Proofpoint documented a significant surge in TA416 (Mustang Panda) targeting of European government entities beginning in the week of Russia's February 2022 invasion of Ukraine. The group increased operational tempo markedly, targeting EU diplomatic and government personnel with Ukraine-themed lures and a new Golang PlugX loader. The campaign was assessed as intelligence collection on European foreign policy responses to the conflict — a high-priority collection requirement for Beijing given China's need to calibrate its own diplomatic positioning on the Ukraine war relative to European partner expectations.
Palo Alto Unit 42 documented a sustained intrusion (CL-STA-0044) into a Southeast Asian government network, attributing it to Stately Taurus (Mustang Panda) with moderate-high confidence based on the exclusive use of ToneShell — a backdoor not publicly attributed to any other threat actor. ToneShell provided persistent reverse shell and downloader access; ShadowPad was deployed in the same environment for supplementary C2. The attackers maintained long-term access, exfiltrating sensitive documents and credentials. This intrusion confirmed ToneShell as a group-unique attribution anchor — comparable to the role BUGHATCH plays for Cuba ransomware attribution.
Unit 42 documented a Mustang Panda campaign in March 2024 targeting organizations connected to the ASEAN-Australia Special Summit, deploying malware packages against targets in Myanmar, the Philippines, Japan, and Singapore with summit timing alignment. The campaign used weaponized archives impersonating summit-related documents, delivering updated ToneShell variants via DLL side-loading. The targeting of summit attendees reflects the group's established pattern of using international diplomatic events as both lure themes and targeting opportunities to collect intelligence on multilateral discussions.
In January 2025, the US Department of Justice announced an international law enforcement operation that removed PlugX malware from over 4,000 infected computers in the United States. The operation was conducted pursuant to nine court-authorized search and seizure warrants and involved cooperation with French law enforcement. Authorities worked with the PlugX malware's own C2 communication protocol to send a self-delete command to infected hosts. While the operation disrupted a significant segment of Mustang Panda's PlugX-based infrastructure in the US, it did not affect ToneShell infrastructure, which was by this point the group's primary tool. Operations resumed with new tooling within months.
Kaspersky documented a campaign beginning in approximately February 2025 against government organizations in Southeast and East Asia — primarily Myanmar and Thailand — using a previously undocumented kernel-mode driver to deliver ToneShell. The driver (ProjectConfiguration.sys), signed with a stolen Guangzhou Kingteller certificate, installs as a minifilter, injects ToneShell from embedded memory-resident shellcode, and protects the injected backdoor from process monitoring and file access. C2 infrastructure was registered via NameCheap in September 2024. Memory forensics is required to detect ToneShell infections from this variant, as no disk-based payload is written.
IBM X-Force discovered SnakeDisk in August 2025 — a 32-bit DLL USB worm executing exclusively on Thailand-IP devices and dropping the Yokai backdoor. The IP geofencing mechanism indicates precisely targeted deployment: operators ensured the worm would only activate in Thai government environments regardless of how widely it propagated via physical media. The timing coincided with escalating Thailand-Cambodia border disputes during 2025, suggesting intelligence collection tasking on Thai government internal communications. Air-gap penetration via USB propagation reflects a deliberate choice to reach workstations with no network-based malware exposure.
IBM X-Force (Hive0154) documented a June 2025 shift in targeting focus toward the Tibetan community, deploying the Pubload backdoor. Pubload received updates in 2025 including decoy C2 server support and HTTP POST shellcode download capability. The Tibetan targeting reflects Beijing's enduring intelligence priority on monitoring Tibetan diaspora organizations and advocacy networks — a consistent Mustang Panda collection focus dating to the group's earliest documented campaigns alongside Mongolian community targeting.
In January 2026, Mustang Panda renewed direct targeting of US government and policy organizations with Venezuela-themed spearphishing emails delivering the LOTUSLITE backdoor — a custom C++ implant communicating with a hard-coded IP-based C2 server to execute remote tasks. The Venezuela lure theme is assessed as reflecting collection interest in US policy toward Venezuelan politics at a period of active diplomatic attention to the region. This campaign confirms Mustang Panda's full operational continuity following the January 2025 PlugX infrastructure disruption, with new infrastructure and tooling reestablished within twelve months.
Tools & Malware
Mustang Panda's arsenal has expanded substantially beyond the PlugX foundation, with a suite of purpose-built tools addressing specific capability gaps: persistence without disk artifacts (kernel rootkit ToneShell delivery), air-gap penetration (SnakeDisk), EDR evasion (SplatCloak), lateral movement through segmented networks (StarProxy), and keylogging without direct C2 exposure (PAKLOG, CorKLOG).
- ToneShell: The group's flagship backdoor since 2022 and the primary attribution anchor for Mustang Panda activity — no other known threat actor has been publicly documented using ToneShell. Provides reverse shell capability and downloader functionality for next-stage malware. Communicates over raw TCP port 443 with fake TLS 1.3 headers. Versions have progressed to Toneshell9 (2025), which added proxy-aware C2 routing through enterprise proxy configurations. A 2025 variant is delivered entirely from kernel-mode rootkit memory injection — leaving no disk-based payload for forensic recovery. Creates a host identifier marker at C:\ProgramData\MicrosoftOneDrive.tlb.
- PlugX (historical, partially disrupted): The original Mustang Panda flagship tool — a modular, widely used Chinese APT RAT first observed in 2008. The group made extensive customizations to PlugX over years of use, including a Golang-based PlugX loader documented in 2020. In January 2025, DOJ/FBI operations removed PlugX from over 4,000 US machines using the malware's own C2 protocol for self-deletion. Still present in some non-US environments; ToneShell has functionally replaced it as the primary tool.
- ProjectConfiguration.sys (kernel rootkit driver): The 2025 kernel-mode driver signed with a stolen Guangzhou Kingteller ATM company certificate. Installs as a Windows minifilter driver at high altitude (intercepting operations before AV drivers), injects ToneShell from embedded shellcode into svchost, disables Microsoft Defender's WdFilter, and registers callbacks to block all attempts to delete or modify its files and registry keys.
- SnakeDisk USB worm: A 32-bit DLL worm discovered in August 2025, executing only on Thailand-IP systems. Propagates via removable USB storage. Drops Yokai backdoor. Configuration encrypted with a two-phase XOR algorithm using a 320-byte key. Uses IOCTL_STORAGE_GET_HOTPLUG_INFO to detect removable devices. Shares API resolution mechanisms with Toneshell9, confirming shared development infrastructure.
- PAKLOG and CorKLOG: Custom keyloggers discovered by Zscaler ThreatLabz in April 2025. PAKLOG uses Windows high-level APIs and custom character encoding. CorKLOG uses a 48-character RC4 encryption key on captured log files with service/task persistence. Neither has built-in C2 exfiltration, requiring complementary tools for data transmission.
- SplatCloak: A Windows kernel driver deployed by SplatDropper that disables notification callbacks registered by four Windows Defender drivers and Kaspersky drivers — preventing endpoint security from receiving OS events. Shares API hashing techniques with ToneShell, confirming common development lineage.
- StarProxy: An internal network proxy tool using FakeTLS-encrypted tunnels for lateral movement through segmented internal networks. Allows operators to reach non-internet-connected hosts by routing through already-compromised internal systems.
- PUBLOAD: A stager/downloader used for second-stage payload delivery. Deployed in Tibetan community targeting campaigns in 2025. Updated variants added decoy C2 server support and HTTP POST shellcode download capability alongside raw TCP TLS-mimicking traffic.
- LOTUSLITE: A custom C++ backdoor introduced in late 2025 / early 2026 campaigns, communicating with a hard-coded IP-based C2 server. Used in January 2026 Venezuela-themed phishing targeting US policy organizations. Supports remote task execution from the C2 server.
- HIUPAN worm: An earlier USB propagation tool documented in campaigns across Vietnam, Cambodia, and the Philippines — a predecessor family to SnakeDisk in the group's USB-based propagation capability set.
- CoolClient backdoor: Documented in 2024–2025 campaigns against Asian and Eastern European government organizations. A more recently discovered addition to the group's toolkit with credential theft modules for major browsers, clipboard monitoring, and data exfiltration via cloud services.
Indicators of Compromise
IOCs from active 2025 campaigns — kernel rootkit ToneShell and SnakeDisk. Network IOCs from the PlugX disruption are no longer reliable as Mustang Panda infrastructure has been largely rebuilt.
Mustang Panda registers new C2 infrastructure regularly. The ToneShell C2 domains below are from the 2025 kernel rootkit campaign and are likely inactive or rotated. Behavioral indicators — particularly the MicrosoftOneDrive.tlb marker file, raw TCP port 443 with fake TLS headers, and DLL side-loading from unexpected directory paths — are substantially more durable detection signals.
Mitigation & Defense
Defending against Mustang Panda requires controls that address both the phishing-based initial access and the increasingly sophisticated post-compromise persistence chain, which now extends to kernel-mode rootkits and air-gap USB propagation.
- HVCI and kernel driver integrity: Enable Hypervisor-Protected Code Integrity (HVCI) on all supported systems. HVCI prevents unsigned or improperly signed kernel drivers from loading — the ProjectConfiguration.sys rootkit relies on a stolen certificate from a company no longer in operation. Ensure certificate revocation lists are current. Monitor for minifilter driver installations via Event ID 6 (kernel driver loaded) outside of software update contexts.
- DLL side-loading detection: Alert on DLL loading by processes from non-standard directories — particularly user-writable paths and temporary folders. Monitor for signed executables spawning processes or loading DLLs from the same directory that were not present at the executable's installation. Mustang Panda's side-loading chains consistently place a legitimate signed binary and a malicious DLL in the same directory, exploiting Windows DLL search order.
- MicrosoftOneDrive.tlb monitoring: Alert on creation of C:\ProgramData\MicrosoftOneDrive.tlb — this file has no legitimate function and is a ToneShell host identifier marker. Its presence indicates an active or prior ToneShell infection.
- Raw TCP port 443 inspection: ToneShell sends raw TCP traffic to port 443 with fake TLS headers rather than genuine TLS. Deep packet inspection solutions capable of distinguishing genuine TLS sessions from TCP traffic with TLS-mimicking headers can detect ToneShell C2 communication. This is distinct from TLS inspection — it requires detecting traffic that appears to be TLS but lacks valid certificate negotiation.
- USB device policy and monitoring: USB propagation via SnakeDisk and HIUPAN worms requires physical USB access to target systems. Enforce USB device policies that block unauthorized removable media on sensitive government workstations. Where USB control is not feasible, implement endpoint monitoring that alerts on new executable content created by USB-connected storage devices.
- Memory forensics capability: The 2025 kernel-mode ToneShell variant leaves no disk-based payload — only the rootkit driver itself and a process injection chain executing from memory. Standard file-based forensics and AV scanning cannot detect the injected ToneShell. Organizations in Mustang Panda target sectors should have memory forensics capability available for incident response, as detecting the injected shellcode in svchost requires live memory analysis.
- Email gateway controls for current-event lures: Mustang Panda's spearphishing lures are systematically themed around news events relevant to target organizations. Block Google Drive direct-download links from external senders. Sandbox RAR, ZIP, and ISO archives before delivery. Monitor for archives containing both a signed executable and a same-directory DLL — a structural indicator of DLL side-loading delivery regardless of specific lure theme.
- SplatCloak detection: Alert on kernel driver installations that modify or disable Windows Defender-registered kernel callback routines. This activity is detectable via Windows security event logging at the minifilter registration level. Any driver that enumerates and removes competing minifilter callbacks should be treated as suspicious.
Mustang Panda's January 2025 PlugX infrastructure disruption represented one of the largest single law enforcement actions against Chinese APT infrastructure in the public record — and demonstrated that the group's operational continuity does not depend on any single tool. ToneShell infrastructure was entirely unaffected, and new campaigns were documented within six months. The transition to kernel-mode rootkit ToneShell delivery in mid-2025 represents a meaningful technical capability jump — matching the stealth characteristics of the Winnti network's PRIVATELOG/STASHLOG CLFS hiding technique, though via a different mechanism. The SnakeDisk USB worm's Thailand-only IP geofencing shows an unusual degree of operational precision for a group characterized as preferring volume over stealth — indicating the group is capable of targeted precision when the mission requires it, and applies "volume over stealth" as a collection philosophy rather than a capability limitation.
Sources & Further Reading
Attribution and references used to build this profile.
- The Hacker News — Mustang Panda Uses Signed Kernel-Mode Rootkit to Load ToneShell Backdoor (2026)
- Kaspersky Securelist — HoneyMyte APT Protects Malware with Kernel-Mode Rootkit (2025)
- IBM X-Force — Hive0154 Drops Updated ToneShell and SnakeDisk USB Worm (2025)
- Zscaler ThreatLabz — Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak (2025)
- Palo Alto Unit 42 — Cyberespionage Against Southeast Asian Government Linked to Stately Taurus (2023)
- Picus Security — Mustang Panda: LOTUSLITE, SnakeDisk, and ToneShell Endpoint Campaign (2025)
- Brandefense — Mustang Panda: Persistent Threat of a China-Aligned Espionage Group in 2025
- MITRE ATT&CK — Group G0129: Mustang Panda
- Security Affairs — Mustang Panda Deploys ToneShell via Signed Kernel-Mode Rootkit Driver (2025)