Loading story…
China-aligned espionage group Mustang Panda carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving SHARDLOADER, MINIRECON, and ZOHOMURK, with active beaconing observed in mid-June.
The most notable tradecraft involved ZOHOMURK abusing Zoho WorkDrive as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo RunOnece, and said it coordinated notification and remediation with CERT-In. Defenders were urged to hunt for indicators including couldinstallup[.]com, the scheduled task SolidPDFPcl2Bmp, suspicious Zoho user agents in non-browser processes, and persistence through HKCU Run keys.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
After identifying active compromises in Indian government networks, Acronis Threat Research Unit coordinated notification and remediation efforts with India's CERT-In. The response followed discovery of affected systems used by senior administrative staff.
Acronis Threat Research Unit identified two concurrent cyber-espionage campaigns by Mustang Panda targeting Indian government entities and hydropower organizations. The activity used spear-phishing, DLL sideloading, and the malware families SHARDLOADER, MINIRECON, and ZOHOMURK to collect intelligence related to hydropower planning and India-Taiwan defense ties.
Researchers observed active beaconing from compromised systems during the Mustang Panda operation. The beaconing window explicitly noted in the reporting ran from June 12 to June 22, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace linked a cyberespionage campaign targeting Asia-Pacific government entities to the Chinese state-aligned group **Mustang Panda**—also tracked as **Twill Typhoon** and **Earth Preta**—after observing the actor evolve its known `.NET` downloader **FDMTP** into a more modular backdoor. The updated framework reportedly supports plugin loading, updates, and persistence while hiding behind legitimate-looking Windows and developer-related processes, indicating a shift from a simple downloader to a more flexible remote access platform. Researchers said compromised hosts had been contacting spoofed domains impersonating CDN infrastructure associated with brands including **Yahoo** and **Apple** since September 2025, and that the attackers repeatedly paired legitimate Windows binaries with malicious DLLs to side-load FDMTP. In one April incident, a finance-sector endpoint fetched binaries, configuration files, and DLL components from **`yahoo-cdn.it.com`** over an 11-day period, underscoring the group's use of modular tooling, deceptive infrastructure, and adaptable persistence techniques in ongoing espionage operations.
Jun 29, 2026
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026
Avast linked a malware distribution and staging infrastructure with high confidence to a Mustang Panda-related threat actor that collected and staged large volumes of stolen data from organizations tied to Myanmar. The campaign targeted government ministries, the Office of the State Administrative Council, police, military entities, embassies, NGOs, and opposition groups, and the exposed material reportedly included documents, emails, browser profiles, audio recordings, military information, diplomatic files, and passport scans belonging to foreign citizens and diplomats. Investigators found an FTP server used to host modular malware and temporarily store exfiltrated victim data, with the operation later shifting to HTTP infrastructure protected only by weak credentials while also using Google Drive, GitHub, and `watercaltropinfo` domains to support exfiltration and token management. Avast said the tooling and tradecraft overlapped with previously reported Mustang Panda and LuminousMoth activity, including Korplug variants, Delphi USB launchers, DLL sideloading chains, and Google Drive-based exfiltration, alongside additional components such as the Go-based `JSX` RAT, keyloggers, file monitors, audio capture tools, modular backdoors, and remote shell capabilities.
Jun 29, 2026