'Infrastructure rotates and payloads can change, but the execution model persists': Chinese hackers return to target victims across Asia with new MustangPanda threat

World Password Day 2025.

• Darktrace reported Twill Typhoon (Mustang Panda) targeting Asia‑Pacific and Japan with updated FDMTP backdoor v3.2.5.1
• Attackers used DLL sideloading via spear‑phished ZIPs with Sogou Pinyin plus malicious DLL, and impersonated Yahoo/Apple CDN traffic
• FDMTP gathers system info, installs plugins for remote control and persistence; researchers stress behavioral detection over static indicators

Chinese state-sponsored threat actors are targeting organizations across the Asia-Pacific region, as well as Japan, with an updated version of a known backdoor, experts have warned.