#mustangpanda — Public Fediverse posts

HoneyMyte aggiorna CoolClient: la backdoor di Mustang Panda ora si nasconde con un rootkit kernel

https://insicurezzadigitale.com/honeymyte-aggiorna-coolclient-la-backdoor-di-mustang-panda-ora-si-nasconde-con-un-rootkit-kernel/

📢⚠️ Watch out as China-linked #MustangPanda is deploying an updated LOTUSLITE backdoor to target Indian banks and South Korean diplomats.

Read: https://hackread.com/mustang-panda-india-s-korea-lotuslite-backdoor/

#CyberSecurity #Malware #India #SouthKorea #China

#mustangpanda

https://lab52.io/blog/plugx-meeting-invitation-via-msbuild-and-gdata/

They switch up how the payload gets delivered to the victim.

#MustangPanda

📢🔍⚠️Chinese-linked Mustang Panda hackers used fake diplomatic briefings to target officials with spyware.

Read: https://hackread.com/chinese-mustang-panda-briefing-spy-diplomat/

#CyberSecurity #China #MustangPanda #CyberAttack #Phishing

quote :
#DreamSecurity 判定這波攻勢是由中國網路間諜組織 #MustangPanda 發動。該組織利用各國的頭條新聞或重要議題作為誘餌，藉此竊取國家機密並潛伏在美國政府機構之中。

#APT

#中國 #駭客 鎖定全球外交官員寄假美國政策檔案　開啟即遭駭入
https://www.cna.com.tw/news/aopl/202602040014.aspx

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

📢⚠️ The China-linked notorious Mustang Panda group is using #Venezuela related news lure to deliver #LOTUSLITE backdoor against US govt targets in a cyberespionage campaign.

Read: https://hackread.com/mastang-panda-venezuela-news-lotuslite-malware/

#CyberSecurity #China #MustangPanda #Malware

HoneyMyte aka Mustang Panda is using a signed rootkit to drop the #ToneShell backdoor in ongoing attacks, hiding its activity from security tools and giving attackers remote access to system.

Read: https://hackread.com/honeymyte-mustang-panda-toneshell-backdoor/

#CyberSecurity #HoneyMyte #MustangPanda #Malware

#mustangpanda #apt e46df5e79880777c4a01ab370bb6f4f3d8d51c57ac0dfdbb9c7370199f363508 SCAN_BC_TH_1389.zip

Chinese APT Phantom Taurus Targeted MS Exchange Servers Over 3 Years https://hackread.com/chinese-apt-phantom-taurus-ms-exchange-servers/ #Cybersecurity #PhantomTaurus #CyberAttacks #IIServerCore #MustangPanda #Afghanistan #CyberAttack #Security #backdoor #Pakistan #Malware #NETSTAR #Winnti #China

Tracing ToneShell: Mustang Panda's Evolving Tradecraft and Campaign Infrastructure
#MUSTANGPANDA
https://www.linkedin.com/pulse/tracing-toneshell-mustang-pandas-evolving-tradecraft-htet-mikoyan--o1s8c/

China-linked APT Mustang Panda upgrades tools in its arsenal – Source: securityaffairs.com https://ciso2ciso.com/china-linked-apt-mustang-panda-upgrades-tools-in-its-arsenal-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #Intelligence #MustangPanda #SecurityNews #hackingnews #Cybercrime #hacking #Malware #China #APT

Hunting Pandas
#MustangPanda
https://intelinsights.substack.com/p/hunting-pandas

☠️ ⛓️‍💥 In a novel attack chain, the threat group #MustangPanda has been combining legitimate components with malicious payloads to reduce likelihood of detection. 😨 Needless to say, it's important for #security teams to know how to spot Mustang Panda’s use of MAVInject in campaigns. 🔍

Follow along in our latest #GraylogLabs article as we emulate an infection chain and analyze the activity it produces in #Graylog. 👁️‍🗨️ We'll walk you through:
⚔️ An attack overview
🗝️ The key elements
😬 Persistence
🦹 Emulating the Adversary
🔍 Detections
💡 Indicators

Read on to also learn threat hunting and detection approaches that you can apply in your own environments! 🙌 👇

https://graylog.org/post/adversary-tradecraft-emulating-mustang-pandas-use-of-mavinject-in-recent-campaigns/ #threathunting #cybersecurity #infosec

I just saw yet another news agency run the whole "MP is using a vulnerability in Windows to hide files!!!" as a legitimate story, when the source still has not disclosed what exactly the problem is and failing to elaborate. It is incredibly frustrating as someone who's been tracking #MustangPanda for nearly 5 years. Here's why I think this is a nothingburger, and people are blowing it out of proportion, and the research is not credible,

- The "vulnerability" is not a vulnerability. It is how desktop.ini works. desktop.ini tells Explorer what properties the folder should contain. This may include things like icon (Logo), folder type (FolderType), name (LocalizedResourceName), and many more.

One of these properties includes CLSID. You can tell Explorer what object the folder should be interpreted as by specifying the corresponding CLSID. For example, {323CA680-C24D-4099-B94D-446DD2D7249E} would correspond to the Favorites folder in Explorer.

The threat group, along with MANY OTHERS, have used this quirk with Explorer to cause Explorer to redirect the folder content to other places, including Favorites, Recycle Bin, and in this case, ActiveX Cache Folder. This is not exclusively used by MP, and has been documented for well over 20 years!
- The research suggests that MP has only recently started using this trick - this is also untrue. They have been known to use this trick since well before PlugDisk became a thing. In fact, they started using this trick all the way back in the early days of late 2010s or even earlier.

- The research mentions that "When files are extracted from compressed RAR files, they are hidden from the user. If the compressed files are extracted into a folder, the folder appears empty in the Windows Explorer GUI."

Yes, because RAR and 7z respects the file attributes created from the source filesystem. In other words, when you compress a folder as System + Hidden, it is going to keep the same S+H attribute when the folder is extracted. Naturally, the user who does not have "Show hidden files" enabled and "Hide protected operating system files" disabled aren't going to see the files.

The research firm also attempted to enumerate the directory via `dir` and it showed no results - because you DIDNT' TELL dir to show hidden files with the `/A:` switch.

- My biggest problem with this research is the sample they linked in the study. The sample they provided is clearly one packed by the victim in Vietnam, and is not used as an initial access. Whilst they never suggested it was used as IA, this is still an incredibly strange example to use because,
1. The sample contains possibly sensitive information (sales data and customer names) from the affected Vietnam firm.
2. The sample does not showcase how PlugDisk could have functioned as-is.
3. The narrative from the research suggested the "vulnerability" all came from this bad RAR file when that is not the case (more on that later).

- The folder you see within the Docusment folder were created by PlugDisk - this folder structure is never used as the first infection factor, nor do they exist on the infected USB drives. This folder is most commonly found in %public%\Publics, but this path can be defined with the PlugDisk config. The desktop.ini is also created by PlugDisk - it does not magically come shipped inside an RAR file.

The whole premise of the research is what ticked me off. This would have been perfectly fine if they were talking about how PlugDisk uses desktop.ini to hide its files, which whilst it wouldn't be anything new, it wouldn't hurt for more people to be more aware of it. Instead, they are going along with the narrative that this was somehow created with a combination of RAR, attrib -s -h, and somehow the victim created RAR file is at fault here.

New Windows Zero-Day Exploited by Chinese APT: Security Firm – Source: www.securityweek.com https://ciso2ciso.com/new-windows-zero-day-exploited-by-chinese-apt-security-firm-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #vulnerabilities #securityweekcom #MustangPanda #securityweek #Exploited #FEATURED #Windows #zeroday #China

New Windows Zero-Day Exploited by Chinese APT: Security Firm https://www.securityweek.com/new-windows-zero-day-exploited-by-chinese-apt-security-firm/ #Vulnerabilities #MustangPanda #exploited #Windows #ZeroDay #China

New Windows Zero-Day Exploited by Chinese APT: Security Firm https://www.securityweek.com/new-windows-zero-day-exploited-by-chinese-apt-security-firm/ #Vulnerabilities #MustangPanda #exploited #Windows #ZeroDay #China

Is anyone aware of the family marked as frozenhill on VT? Looks like files marked as this family in the VT config extractor are related to the files found in Avast's report back in 2021 on #MustangPanda - but there doesn't seem to be a publicly documented method of extracting the data.

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers – Source: www.securityweek.com https://ciso2ciso.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #JusticeDepartment #Malware&Threats #securityweekcom #MustangPanda #securityweek #Government #China #PlugX #fbi

The #FBI has mass-removed the #PlugX #malware from infected US computers. The infections were attributed to #MustangPanda (aka #TwillTyphoon).

Remember this is just one botnet of #PlugX it's still used in the wild by many other threat actor groups.

For you #DFIR folks, ensure you know how to go #ThreatHunting for DLL-Side Loading to find #PlugX in your network.

https://www.bleepingcomputer.com/news/security/fbi-wipes-chinese-plugx-malware-from-over-4-000-us-computers/
#IncidentResponse

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers https://www.securityweek.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers/ #JusticeDepartment #Malware&Threats #MustangPanda #Government #China #PlugX #FBI

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers https://www.securityweek.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers/ #JusticeDepartment #Malware&Threats #MustangPanda #Government #China #PlugX #FBI

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers
#MustangPanda #PlugX
https://www.justice.gov/opa/pr/justice-department-and-fbi-conduct-international-operation-delete-malware-used-china-backed

FBI deleted China-linked PlugX malware from over 4,200 US computers – Source: securityaffairs.com https://ciso2ciso.com/fbi-deleted-china-linked-plugx-malware-from-over-4200-us-computers-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #BreakingNews #MustangPanda #PlugXmalware #SecurityNews #hackingnews #CyberCrime #Cybercrime #Security #hacking #Malware #APT