China-Linked Mustang Panda Deploys New USB Worm and Updated Backdoor
Cybersecurity researchers have uncovered fresh activity from the China-aligned threat group Mustang Panda , which is now deploying an upgraded version of its TONESHELL backdoor alongside a new USB worm dubbed SnakeDisk . Mustang Panda’s New Cyber Tools According to a recent analysis by IBM X-Force , SnakeDisk is engineered to run only on devices with Thailand-based IP addresses , where it delivers the Yokai backdoor to establish remote access. This discovery highlights the group’s evolving tactics and its growing focus on Southeast Asia. Updated TONESHELL Variants Originally documented in 2022, TONESHELL has been a staple in Mustang Panda’s campaigns across Myanmar, Australia, the Philippines, Japan, and Taiwan. The malware is typically spread through spear-phishing emails , often dropped alongside families like PUBLOAD , which also deliver shellcode payloads from remote command-and-control (C2) servers. IBM identified two new variants— TONESHELL8 and TONESHELL9 —capable of comm...