Loading story…
Darktrace linked a cyberespionage campaign targeting Asia-Pacific government entities to the Chinese state-aligned group Mustang Panda—also tracked as Twill Typhoon and Earth Preta—after observing the actor evolve its known .NET downloader FDMTP into a more modular backdoor. The updated framework reportedly supports plugin loading, updates, and persistence while hiding behind legitimate-looking Windows and developer-related processes, indicating a shift from a simple downloader to a more flexible remote access platform.
Researchers said compromised hosts had been contacting spoofed domains impersonating CDN infrastructure associated with brands including Yahoo and Apple since September 2025, and that the attackers repeatedly paired legitimate Windows binaries with malicious DLLs to side-load FDMTP. In one April incident, a finance-sector endpoint fetched binaries, configuration files, and DLL components from yahoo-cdn.it.com over an 11-day period, underscoring the group's use of modular tooling, deceptive infrastructure, and adaptable persistence techniques in ongoing espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On or before May 14, 2026, Darktrace reported that the Asia-Pacific government-targeting cyberespionage campaign resembled activity by the Chinese state-aligned threat actor Mustang Panda, also known as Twill Typhoon and Earth Preta. The report said the group had evolved FDMTP from a .NET downloader into a modular backdoor framework supporting plugins, updates, and persistence via legitimate-looking processes.
In April 2026, Darktrace documented an incident in which a finance-sector endpoint repeatedly fetched binaries, configuration files, and DLL components from yahoo-cdn.it.com over an 11-day period. The behavior was consistent with the modular FDMTP framework and its plugin-based operation.
Darktrace observed compromised hosts from September 2025 contacting spoofed domains impersonating CDN infrastructure associated with brands including Yahoo and Apple. The activity involved retrieving legitimate Windows binaries and malicious DLLs to side-load an evolved, more modular version of the FDMTP malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcedarktrace.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Jun 30, 2026
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026
Avast linked a malware distribution and staging infrastructure with high confidence to a Mustang Panda-related threat actor that collected and staged large volumes of stolen data from organizations tied to Myanmar. The campaign targeted government ministries, the Office of the State Administrative Council, police, military entities, embassies, NGOs, and opposition groups, and the exposed material reportedly included documents, emails, browser profiles, audio recordings, military information, diplomatic files, and passport scans belonging to foreign citizens and diplomats. Investigators found an FTP server used to host modular malware and temporarily store exfiltrated victim data, with the operation later shifting to HTTP infrastructure protected only by weak credentials while also using Google Drive, GitHub, and `watercaltropinfo` domains to support exfiltration and token management. Avast said the tooling and tradecraft overlapped with previously reported Mustang Panda and LuminousMoth activity, including Korplug variants, Delphi USB launchers, DLL sideloading chains, and Google Drive-based exfiltration, alongside additional components such as the Go-based `JSX` RAT, keyloggers, file monitors, audio capture tools, modular backdoors, and remote shell capabilities.
Jun 29, 2026