Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver

GlobalDefenseBot 30 December

4 minutes

China-linked APT Mustang Panda used a signed kernel-mode rootkit driver to load shellcode and deploy its ToneShell backdoor. China-linked APT Mustang Panda (aka Hive0154, HoneyMyte, Camaro Dragon, RedDelta or Bronze President) was observed using a signed kernel-mode rootkit driver with embedded shellcode to deploy its ToneShell backdoor. Mustang Panda has been active since at least 2012, targeting American and European entities such as […]

Securelist

HoneyMyte (aka Mustang Panda) Deploys ToneShell Backdoor in New Attacks

CySecBot 30 December

1 minute

HoneyMyte (Mustang Panda) is back with a new ToneShell backdoor. Read how this stealthy attack blinds Microsoft Defender to target government entities in Asia.

EmEditor Homepage Download Button Served Malware for 4 Days

CySecBot 30 December

1 minute

Warning for EmEditor users: A third-party breach tampered with the official download link between Dec 19–22, 2025. Learn how to identify the fake installer and protect your data from infostealer malware.

breaking news

Lithuanian suspect arrested over KMSAuto malware that infected 2.8M systems

GlobalDefenseBot 30 December

3 minutes

A Lithuanian national was arrested for allegedly spreading KMSAuto malware that stole clipboard data and infected 2.8 million Windows and Office systems. A Lithuanian man (29) was arrested for allegedly spreading KMSAuto-based clipboard-stealing malware that infected about 2.8 million Windows and Office systems. The man was extradited from Georgia to South Korea under Interpol coordination. […]

Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

CySecBot 30 December

1 minute

The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.
The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek.

breaking news

Romania’s Oltenia Energy Complex suffers major ransomware attack

GlobalDefenseBot 30 December

3 minutes

A ransomware attack hit Romania’s Oltenia Energy Complex on December 26, knocking out IT systems at the country’s largest coal power producer. A ransomware attack disrupted Oltenia Energy Complex, Romania’s largest coal-based power producer, shutting down its IT systems on December 26. The Oltenia Energy Complex (CE Oltenia) is Romania’s leading state-controlled lignite mining and […]

Infostealer Malware Delivered in EmEditor Supply Chain Attack

CySecBot 29 December

1 minute

The ‘download’ button on the official EmEditor website served a malicious installer.
The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek.

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

CySecBot 29 December

11 minutes

Kaspersky discloses a 2025 HoneyMyte (aka Mustang Panda or Bronze President) APT campaign, which uses a kernel-mode rootkit to deliver and protect a ToneShell backdoor.

Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor

GlobalDefenseBot 29 December

5 minutes

China-linked APT Evasive Panda used DNS poisoning to deliver the MgBot backdoor in targeted cyber-espionage attacks in Türkiye, China, and India. Kaspersky researchers spotted the China-linked APT group Evasive Panda (aka Daggerfly, Bronze Highland, and StormBamboo) running a targeted cyber-espionage campaign using DNS poisoning to deliver the MgBot backdoor against victims in Türkiye, China, and […]

breaking news

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 77

GlobalDefenseBot 28 December

1 minute

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan From Linear to Complex: An Upgrade in RansomHouse Encryption Prince of Persia: A Decade of Iranian Nation-State APT Campaign […]