Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems

According to IBM X-Force researchers, sophisticated new malware campaigns are being conducted by the China-aligned threat actor Hive0154, also known as Mustang Panda. The findings include an advanced Toneshell backdoor variant, dubbed Toneshell9, that evades detection and uses proxy-aware communication to blend with enterprise traffic, along with a novel USB worm called SnakeDisk that targets Thailand-based devices.

The SnakeDisk worm checks for Thailand-based IP addresses before execution and is designed to infect removable storage to drop the Yokai backdoor for persistent remote access. The campaign highlights dual reverse shell functionality, proxy configuration management, and enhanced evasion techniques such as junk code injection with strings generated from ChatGPT, all to operate within air-gapped environments.

Security researchers note the timing aligns with escalating Thailand-Cambodia tensions in 2025, underscoring a geographically targeted approach against government and organisational networks in the region.