Loading malware…
TONESHELL is a custom Windows backdoor associated with the China-aligned threat actor Mustang Panda, including clusters and aliases such as Hive0154 and Stately Taurus. It has been publicly documented since at least 2022 and is repeatedly described as part of Mustang Panda’s malware arsenal, with some reporting stating it is believed to be used exclusively by Stately Taurus. It is commonly delivered via DLL side-loading, including trojanized archives and legitimate signed executables, and its primary role is to establish a foothold and download or launch next-stage payloads. Reported campaigns include targeting organizations in Southeast Asia, Myanmar, Thailand-linked activity, and later espionage operations against Indian government and hydropower-sector entities through a reworked derivative called MINIRECON.
Observed TONESHELL capabilities include remote command execution, file upload and download, drop-and-execute functionality, and reverse shell support. Multiple reports note that TONESHELL facilitates inter-process communication via pipes and can create reverse shells using anonymous pipes. Newer variants introduced stronger evasion and communications features: Toneshell8 added junk code and changed its pseudo-random number generation to a custom linear congruential generator used for victim IDs, C2 encryption keys, and beacon authenticity checks; Toneshell9 added proxy-aware command and control, fake TLS 1.2 application-data beacon framing beginning with bytes 17 03 03, storage of a random 16-byte victim GUID in C:\ProgramData\ProgrammaticallyCpp.inc, creation of an event named Windows External Module to prevent duplicate execution, and support for two concurrent reverse shells using cmd.exe and anonymous pipes. Toneshell9 also enumerates Windows registry hives to discover local proxy settings and can communicate through HTTP, HTTPS, FTP, or SOCKS proxies.
Persistence mechanisms attributed to TONESHELL include creation of a malicious service named DISMsrv and creation of scheduled tasks. Reporting also states that Mustang Panda has used valid legitimate digital signatures and certificates to evade detection, and one updated TONESHELL variant was specifically noted as evading VirusTotal detections at the time of reporting.
Infrastructure and overlap indicators directly mentioned in the content include C2 IPs and domains such as 146.70.29[.]229 for Toneshell7/8, 123.253.34[.]44 and www.slickvpn[.]com for Toneshell9, and historical infrastructure overlap with Bookworm and PubLoad. Unit 42 reported a shared PDB path, C:\Users\hack\Documents\WhiteFile\LTDIS13n\Release\LTDIS13n.pdb, between ToneShell and Bookworm samples, as well as overlapping infrastructure including www.uvfr4ep[.]com and IPs 103.27.202[.]68 and 103.27.202[.]87. Acronis described MINIRECON as a reworked TONESHELL variant that retained traits such as PEB walking, API hashing with the 13131313 multiplier, LCG-based XOR beacon encryption, proxy fallback, WebSocket-over-HTTPS C2, and communication with couldinstallup[.]com over port 443.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Details on Exploited Vulnerabilities ... CVE-2021-40444 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve2 = “CVE-2021-40444”
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This includes an updated Toneshell variant evading detections and supporting several new features... One of the variants evading VirusTotal detections is the latest update "Toneshell9".
This includes an updated Toneshell variant evading detections and supporting several new features... One of the variants evading VirusTotal detections is the latest update "Toneshell9".
Prior research by Trend Micro had identified technical overlaps between TA416 and UNK_SteadySplit, most notably through a UNK_SteadySplit TONESHELL command-and-control (C2) IP address embedded in a filepath within two LNK files used in TA416 campaigns.
“ToneShell, a backdoor used by Mustang Panda, has been updated with changes to its FakeTLS command-and-control (C2) communication protocol…”
29 distinct techniques documented for this family, organized by ATT&CK tactic.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
facilitate two active reverse shells in parallel... Yokai, a backdoor that sets up a reverse shell to execute arbitrary commands.
Similar to previous variants, a reverse shell is set up using anonymous pipes connected to stdin and stdout handles of a new cmd.exe process... Toneshell operators can write string data to the pipe using the correct shell_id and execute arbitrary commands on the machine.
"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'
Using ASCII or decoded Base64 strings that represent UUID strings. Calling UuidFromStringA to convert the decoded UUIDs to binary data, each of which represents 16 bytes of shellcode.
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. ... Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
The most recent Pubload variant has undergone minor changes and now supports decoy C2 servers and downloading shellcode payloads via HTTP POST in addition to raw TCP imitating TLS traffic.
MINIRECON is a reworked variant of the Toneshell backdoor, previously documented by IBM X-Force. It communicates with attacker servers over a WebSocket connection on HTTPS, making it harder to detect through standard network monitoring.
The most recent Pubload variant has undergone minor changes and now supports decoy C2 servers and downloading shellcode payloads via HTTP POST in addition to raw TCP imitating TLS traffic.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously documented backdoor family referenced because MINIRECON is described as a reworked variant of it.
Referenced as the backdoor family from which MINIRECON was reworked.
Previously documented Mustang Panda malware family referenced because MINIRECON shares architectural and functional similarities with it, including API hashing, encryption routines, command handling, and anti-analysis techniques.
Referenced as part of Mustang Panda's malware evolution alongside LOTUSLITE and other tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.