Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

Dec 30, 2026Ravie LakshmananMalware / Cyber Espionage

The Chinese hacking group known as Mustang Panda has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber…