ToneShell Backdoor Evolves With Anti-Analysis Tricks, Continues Targeting Myanmar

Intezer researchers have released a technical analysis of a new ToneShell variant, a lightweight backdoor tied to the China-nexus group Mustang Panda, which is now showing enhanced anti-analysis capabilities while continuing to target Myanmar.

According to Intezer, ToneShell is typically delivered via DLL sideloading inside compressed archives with legitimate signed executables and is often spread through cloud-hosted lures; the sample analyzed was distributed in a ZIP archive masquerading as a document related to Myanmar’s revolutionary forces and compiled in July 2025.

The backdoor is delivered as a DLL named SkinH.dll and achieves persistence by copying itself into the user’s AppData directory and registering a scheduled task named dokanctl, which executes every minute, while enforcing a single-instance mutex. It checks for Google Drive-related processes, likely to avoid infecting its operators’ own systems, and uses a TLS-like header with a rolling XOR scheme to obfuscate its payload, connecting to 146.70.29[.]229:443 for command-and-control.

The analysis notes that the variant emphasises anti-analysis techniques to waste analyst time and confuse automated tools, including repeated file churn, randomized sleep delays, and opaque string comparisons, with researchers describing the sample as a hybrid that blends features from earlier ToneShell versions. This underlines Mustang Panda’s persistent cyber espionage operations in Myanmar and the ongoing refinement of evasion methods in the geopolitical targeting of the region.