Loading story…
China-aligned espionage group Mustang Panda carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving SHARDLOADER, MINIRECON, and ZOHOMURK, with active beaconing observed in mid-June.
The most notable tradecraft involved ZOHOMURK abusing Zoho WorkDrive as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo RunOnece, and said it coordinated notification and remediation with CERT-In. Defenders were urged to hunt for indicators including couldinstallup[.]com, the scheduled task SolidPDFPcl2Bmp, suspicious Zoho user agents in non-browser processes, and persistence through HKCU Run keys.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
After identifying active compromises in Indian government networks, Acronis Threat Research Unit coordinated notification and remediation efforts with India's CERT-In. The response followed discovery of affected systems used by senior administrative staff.
Acronis Threat Research Unit identified two concurrent cyber-espionage campaigns by Mustang Panda targeting Indian government entities and hydropower organizations. The activity used spear-phishing, DLL sideloading, and the malware families SHARDLOADER, MINIRECON, and ZOHOMURK to collect intelligence related to hydropower planning and India-Taiwan defense ties.
Researchers observed active beaconing from compromised systems during the Mustang Panda operation. The beaconing window explicitly noted in the reporting ran from June 12 to June 22, 2026.
IBM X-Force reported that Mustang Panda targeted Indian government and energy-sector entities in May 2026 using Nepal Ministry of Foreign Affairs-themed spearphishing tied to hydropower issues. The campaign used Claimloader to sideload and deploy Toneshell v10, and the report also identified the Havencode VNC-capable backdoor and related infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceibm.com
Open sourcesocradar.io
Open sourcecybersecuritynews.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
A China-linked espionage group tracked as **Mustang Panda** targeted India’s banking sector and South Korean policy circles with an updated **LOTUSLITE** backdoor, according to Acronis Threat Research. In India, the attackers used **HDFC Bank**-themed `.chm` lure files that fetched a JavaScript payload from `cosmosmusic[.]com`, displayed fake banking pop-ups, and established persistence on infected systems. In South Korea, the operation used a fake Gmail account impersonating **Victor Cha** and malicious invitation documents hosted on Google Drive to target policy-makers and geopolitical experts. Researchers said the newer **LOTUSLITE v1.1** variant improves stealth through **DLL sideloading** with legitimate Microsoft-signed executables, runtime API resolution via `ntdll.dll` call chains, and altered network markers and command flags. Acronis attributed the campaign to Mustang Panda with moderate confidence, citing shared code lineage, reused infrastructure, overlapping command structures, use of **Dynu Systems** dynamic DNS, and recurring operational patterns linking the India and South Korea intrusions.
Aug 14, 2026
Researchers reported that the China-linked espionage group **Mustang Panda** (`TA416`, `RedDelta`, `PKPLUG`) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files. The intrusions delivered a previously undocumented **Korplug/PlugX** variant dubbed **Hodur**, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as **SmadAV**, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with **RC4**, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Aug 15, 2026