Loading story…
Avast linked a malware distribution and staging infrastructure with high confidence to a Mustang Panda-related threat actor that collected and staged large volumes of stolen data from organizations tied to Myanmar. The campaign targeted government ministries, the Office of the State Administrative Council, police, military entities, embassies, NGOs, and opposition groups, and the exposed material reportedly included documents, emails, browser profiles, audio recordings, military information, diplomatic files, and passport scans belonging to foreign citizens and diplomats.
Investigators found an FTP server used to host modular malware and temporarily store exfiltrated victim data, with the operation later shifting to HTTP infrastructure protected only by weak credentials while also using Google Drive, GitHub, and watercaltropinfo domains to support exfiltration and token management. Avast said the tooling and tradecraft overlapped with previously reported Mustang Panda and LuminousMoth activity, including Korplug variants, Delphi USB launchers, DLL sideloading chains, and Google Drive-based exfiltration, alongside additional components such as the Go-based JSX RAT, keyloggers, file monitors, audio capture tools, modular backdoors, and remote shell capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2022-12-02, Avast published research describing the actor's infrastructure evolution from anonymous FTP in Malaysia to HTTP with weak credentials, along with use of Google Drive, GitHub, and watercaltropinfo domains. The report also detailed malware and tradecraft associated with the campaign, including Korplug variants, Delphi USB launchers, DLL sideloading chains, a Go-based RAT called JSX, keyloggers, file monitors, audio capture tools, and remote shell capabilities.
Avast reported a malware distribution and staging infrastructure linked with high confidence to a Mustang Panda-related threat actor targeting Myanmar government ministries, military and police organizations, embassies, NGOs, and opposition groups. The operation involved large-scale collection and temporary storage of exfiltrated victim data, including documents, emails, browser profiles, audio recordings, military information, diplomatic materials, and passport scans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace linked a cyberespionage campaign targeting Asia-Pacific government entities to the Chinese state-aligned group **Mustang Panda**—also tracked as **Twill Typhoon** and **Earth Preta**—after observing the actor evolve its known `.NET` downloader **FDMTP** into a more modular backdoor. The updated framework reportedly supports plugin loading, updates, and persistence while hiding behind legitimate-looking Windows and developer-related processes, indicating a shift from a simple downloader to a more flexible remote access platform. Researchers said compromised hosts had been contacting spoofed domains impersonating CDN infrastructure associated with brands including **Yahoo** and **Apple** since September 2025, and that the attackers repeatedly paired legitimate Windows binaries with malicious DLLs to side-load FDMTP. In one April incident, a finance-sector endpoint fetched binaries, configuration files, and DLL components from **`yahoo-cdn.it.com`** over an 11-day period, underscoring the group's use of modular tooling, deceptive infrastructure, and adaptable persistence techniques in ongoing espionage operations.
Jun 29, 2026
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Jun 30, 2026
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026