Loading story…
Researchers reported a suspected Mustang Panda intrusion campaign using politically themed lure files tied to Asian diplomatic relationships, including a shortcut file named 新段階に入った日印の戦略的関係.pdf.lnk that was believed to target Japan's Ministry of Foreign Affairs and Ministry of Defense. The lure referenced the deepening strategic relationship between Japan and India, aligning with the group's known interest in regional geopolitics and security cooperation such as the Quad.
A related analysis linked the activity to PulseRAT, a remote access trojan that used a UAE-India partnership lure and relied on Google Sheets for command-and-control functionality. Taken together, the reports indicate an espionage-focused operation using diplomatic and strategic partnership themes to socially engineer targets and deploy malware against government or policy-linked entities in Asia.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
A malicious LNK file named "新段階に入った日印の戦略的関係.pdf.lnk" was assessed as likely targeting Japan's Ministry of Foreign Affairs and Ministry of Defense. The post describes the attribution to Mustang Panda as suspected rather than confirmed.
A PulseRAT remote access trojan campaign used a lure themed around the UAE-India partnership, according to the referenced analysis. The provided content does not explicitly anchor when the campaign occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedmpdump.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Aug 22, 2026
A China-linked espionage group tracked as **Mustang Panda** targeted India’s banking sector and South Korean policy circles with an updated **LOTUSLITE** backdoor, according to Acronis Threat Research. In India, the attackers used **HDFC Bank**-themed `.chm` lure files that fetched a JavaScript payload from `cosmosmusic[.]com`, displayed fake banking pop-ups, and established persistence on infected systems. In South Korea, the operation used a fake Gmail account impersonating **Victor Cha** and malicious invitation documents hosted on Google Drive to target policy-makers and geopolitical experts. Researchers said the newer **LOTUSLITE v1.1** variant improves stealth through **DLL sideloading** with legitimate Microsoft-signed executables, runtime API resolution via `ntdll.dll` call chains, and altered network markers and command flags. Acronis attributed the campaign to Mustang Panda with moderate confidence, citing shared code lineage, reused infrastructure, overlapping command structures, use of **Dynu Systems** dynamic DNS, and recurring operational patterns linking the India and South Korea intrusions.
Aug 14, 2026