Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7) +--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445) +---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89) +---- Thread: Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor (/showthread.php?tid=6317444)

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor - Stanley - Jan 8, 2026 Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor The Chinese hacking group known as Mustang Panda (aka HoneyMyte) has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia. The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group https://thehackernews.com/2025/12/mustang-panda-uses-signed-kernel-driver.html