Researchers identify new ToneShell backdoor targeting government agencies

Proactive Cybersecurity Service That Neutralizes Threats Within a Digital Network - Conceptual Illustration.

• Mustang Panda deployed upgraded ToneShell backdoors against Asian government organizations
• New variant uses signed mini-filter driver, enabling rootkit-like stealth and Defender tampering
• Kaspersky advises memory forensics and IoCs to detect infections in compromised systems

Chinese state-sponsored threat actors, known as Mustang Panda, have been observed targeting government organizations of various Asian countries with an upgraded version of the ToneShell backdoor.