Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

The Chinese hacking group Mustang Panda has used a previously undocumented kernel-mode rootkit driver to deliver a new variant of the backdoor dubbed TONESHELL, in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia.

According to Kaspersky, the driver file, named ProjectConfiguration.sys, is signed with a digital certificate from Guangzhou Kingteller Technology Co., Ltd, and registers as a minifilter driver on infected machines to inject the backdoor into system processes and protect malicious files, user-mode processes, and registry keys.

The backdoor’s final payload is TONESHELL, which provides reverse shell and downloader capabilities and communicates with C2 servers avocadomechanism[.]com or potherbreference[.]com over TCP port 443. The campaign is attributed to Mustang Panda since at least late 2022, with the kernel-mode loader marking a first for delivering TONESHELL in this manner to improve stealth and resilience.

The driver drops two user-mode payloads, including one that spawns svchost.exe and injects a delay-inducing shellcode, and it targets government organisations in Southeast and East Asia, especially Myanmar and Thailand. Memory forensics are emphasised as essential for detecting the injected shellcode and the backdoor’s activity.