China-Linked Mustang Panda Deploys New USB Worm and Updated Backdoor

Cybersecurity researchers have uncovered fresh activity from the China-aligned threat group Mustang Panda, which is now deploying an upgraded version of its TONESHELL backdoor alongside a new USB worm dubbed SnakeDisk.

Mustang Panda’s New Cyber Tools

According to a recent analysis by IBM X-Force, SnakeDisk is engineered to run only on devices with Thailand-based IP addresses, where it delivers the Yokai backdoor to establish remote access. This discovery highlights the group’s evolving tactics and its growing focus on Southeast Asia.

Updated TONESHELL Variants

Originally documented in 2022, TONESHELL has been a staple in Mustang Panda’s campaigns across Myanmar, Australia, the Philippines, Japan, and Taiwan. The malware is typically spread through spear-phishing emails, often dropped alongside families like PUBLOAD, which also deliver shellcode payloads from remote command-and-control (C2) servers.

IBM identified two new variants—TONESHELL8 and TONESHELL9—capable of communicating through enterprise proxy servers to disguise malicious traffic. They can also maintain two active reverse shells simultaneously. Notably, TONESHELL8 includes junk code copied from OpenAI’s ChatGPT website to evade detection and resist analysis.

SnakeDisk: A New USB Worm

SnakeDisk, launched via DLL side-loading, is an evolution of the group’s earlier worm framework TONEDISK (aka WispRider). It spreads by moving files on a USB device into a hidden folder, tricking victims into clicking a malicious executable disguised as either the device’s volume name or “USB.exe.” After infecting a new machine, the files are restored to their original location to avoid suspicion.

Once executed, SnakeDisk drops the Yokai backdoor, which creates a reverse shell to run arbitrary commands. Yokai was previously linked to intrusions targeting Thai officials, according to research published in late 2024.

A Growing Malware Ecosystem

Mustang Panda, also tracked as Hive0154, Bronze President, Camaro Dragon, and RedDelta, has been active since at least 2012. Researchers say its continued development of new tools and subclusters shows it is a highly capable state-sponsored actor with a large, overlapping malware ecosystem.

“The use of SnakeDisk and Yokai likely points to a subgroup within Mustang Panda hyper-focused on Thailand,” IBM noted, stressing that the campaign underscores the actor’s ongoing refinement of attack techniques.