Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Google Says AI Is Accelerating Supply Chain and Cloud Attacks

Part of the MUSTANG PANDA story · since 26 Aug 2025

Quiet for 6 weekslast report 14 Sep39 articles11 outlets
26 Aug · GBHackers first29 Mar10 Jun22 AugNowThis article39th of 39
  • Tue 26 Aug, 12:25 UTC. GBHackers, first report. Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection.
  • Tue 26 Aug, 19:11 UTC. GBHackers. China-Based Threat Actor Mustang Panda’s TTPs Leaked.
  • Tue 26 Aug, 23:15 UTC. BleepingComputer, its first report on the story. Silk Typhoon hackers hijack network captive portals in diplomat attacks.
  • Wed 27 Aug, 03:30 UTC. SecurityOnline, its first report on the story. Google Threat Intelligence Exposes UNC6384’s Stealthy Espionage Campaign.
  • Wed 27 Aug, 09:45 UTC. Security Affairs, its first report on the story. China linked Silk Typhoon targeted diplomats by hijacking web traffic.
  • Fri 12 Sep, 00:30 UTC. SecurityOnline. ToneShell Backdoor Evolves With Anti-Analysis Tricks, Continues Targeting Myanmar.
  • Sat 13 Sep, 18:51 UTC. GBHackers. Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems.
  • Mon 15 Sep, 02:16 UTC. SecurityOnline. China-Aligned Hackers Unleash Upgraded Toneshell and New USB Worm.
  • Mon 15 Sep, 19:10 UTC. The Hacker News, its first report on the story. Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs.
  • Tue 16 Sep, 08:16 UTC. Security Affairs. China-linked Mustang Panda deploys advanced SnakeDisk USB worm.
  • Wed 24 Sep, 21:35 UTC. Unit 42, its first report on the story. Bookworm to Stately Taurus Using the Unit 42 Attribution Framework.
  • Tue 7 Oct, 06:35 UTC. GBHackers. Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware.
  • Wed 8 Oct, 03:31 UTC. SecurityOnline. Mustang Panda APT Uses Hidden DLL and EnumFontsW to Launch Stealthy Tibet-Themed Campaign.
  • Fri 31 Oct, 20:25 UTC. Dark Reading, its first report on the story. UNC6384 Targets European Diplomatic Entities With Windows Exploit.
  • Sat 1 Nov, 14:30 UTC. Security Affairs. China-linked UNC6384 exploits Windows zero-day to spy on European diplomats.
  • Mon 3 Nov, 02:41 UTC. SecurityOnline. Chinese APT UNC6384 Pivots to Europe, Exploits Windows LNK Flaw to Deploy PlugX via Canon DLL Sideloading.
  • Mon 29 Dec, 10:10 UTC. Securelist, its first report on the story. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor.
  • Tue 30 Dec, 09:05 UTC. The Hacker News. Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor.
  • Tue 30 Dec, 10:15 UTC. SecurityWeek, its first report on the story. Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit.
  • Tue 30 Dec, 16:15 UTC. Security Affairs. Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver.
  • Thu 1 Jan, 01:21 UTC. SecurityOnline. The Ghost in the Kernel: How HoneyMyte Weaponized a Rootkit to Hijack Asian Governments.
  • Tue 13 Jan, 08:41 UTC. trendmicro.com, its first report on the story. Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™.
  • Mon 19 Jan, 00:50 UTC. SecurityOnline. New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign.
  • Tue 27 Jan, 08:30 UTC. Securelist. HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns.
  • Wed 28 Jan, 01:35 UTC. SecurityOnline. HoneyMyte Evolved: Spies Use Pixeldrain & CoolClient for Real-Time Surveillance.
  • Wed 28 Jan, 13:30 UTC. The Hacker News. Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks.
  • Wed 1 Apr, 12:44 UTC. Infosecurity, its first report on the story. Chinese Hackers Target European Governments in Espionage Campaigns.
  • Fri 3 Apr, 18:11 UTC. The Hacker News. China linked TA416 revives EU govt espionage using cloud PlugX.
  • Tue 21 Apr, 12:32 UTC. Dark Reading. Mustang Panda hits Indian banks with LotusLite backdoor.
  • Wed 22 Apr, 08:41 UTC. The Hacker News. Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 14 May, 15:10 UTC. Infosecurity. FDMTP backdoor v3.2 update tied to Mustang Panda espionage.
  • Mon 29 Jun, 16:48 UTC. The Hacker News. Mustang Panda leverages Zoho WorkDrive against Indian government.
  • Thu 2 Jul, 08:41 UTC. SecurityOnline. Mustang Panda spies on India using Zoho WorkDrive for hydropower.
  • Fri 7 Aug, 08:31 UTC. SecurityOnline. Supply chain attack hijacks QuickFox, targets Chinese students.
  • Fri 14 Aug, 09:26 UTC. Securelist. HoneyMyte APT's CoolClient backdoor gains kernel stealth driver.
  • Sun 16 Aug, 17:31 UTC. Security Affairs. Mustang Panda's CoolClient gains signed driver for stealth.
  • Wed 19 Aug, 10:22 UTC. SecurityOnline. HoneyMyte updates CoolClient rootkit to spy on Asian, Russian govt.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. Google Says AI Is Accelerating Supply Chain and Cloud Attacks. This article, 39th of 39.

Google Threat Intelligence Group (GTIG) says suspected state-sponsored groups and cybercriminals are using artificial intelligence to accelerate software supply-chain attacks, credential theft and cloud-resource hijacking. The activity reportedly targets healthcare, government and media organisations, as well as software developers, with attackers seeking proprietary models, source code and API keys.

GTIG said one cloud resource was compromised and then used to plan, build and execute an agent-enabled mass credential-harvesting campaign in under six hours.

The report names financially motivated UNC6780, which allegedly compromised legitimate developer accounts to inject malicious code into repository environments, and suspected China-nexus group BASIN CASTLE, which used generative tools to profile targets and translate localised phishing lures. A suspected Russia-based group, UNC5792, reportedly automated analysis of Telegram channels and obtained developer credentials by stealing them or buying compromised platform accounts.

GTIG also observed an autonomous framework called “Recon” organising and validating more than 23,800 harvested secrets, including cloud-service API keys. Other campaigns reportedly exceeded 100 million model-distillation prompts, although the article does not establish specific victims or financial losses.

The recommended response includes monitoring continuous-integration pipelines for unusual activity, restricting outbound connections from build environments, auditing cloud quotas for hijacking and applying strict access controls. Organisations are also advised to monitor API usage for anomalies. The article attributes the findings to GTIG and describes the groups as suspected; it does not report official charges or confirm exploitation of particular named victims.

How the story developed

All 39 articles
Quiet for 6 weekslast report 14 Sep39 articles11 outlets

39 articles from 11 outlets since 26 Aug. Quiet since 14 Sep. This was the 39th report, 384 days after the first.

Now26 Aug2419134272321146292521145First reportGBHackers · 26 Aug, 12:25This article39th of 39 · day 384Picked up againafter 2 weeks quiet
  • Tue 26 Aug, 12:25 UTC. GBHackers, first report. Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection.
  • Tue 26 Aug, 19:11 UTC. GBHackers. China-Based Threat Actor Mustang Panda’s TTPs Leaked.
  • Tue 26 Aug, 23:15 UTC. BleepingComputer, its first report on the story. Silk Typhoon hackers hijack network captive portals in diplomat attacks.
  • Wed 27 Aug, 03:30 UTC. SecurityOnline, its first report on the story. Google Threat Intelligence Exposes UNC6384’s Stealthy Espionage Campaign.
  • Wed 27 Aug, 09:45 UTC. Security Affairs, its first report on the story. China linked Silk Typhoon targeted diplomats by hijacking web traffic.
  • Fri 12 Sep, 00:30 UTC. SecurityOnline. ToneShell Backdoor Evolves With Anti-Analysis Tricks, Continues Targeting Myanmar.
  • Sat 13 Sep, 18:51 UTC. GBHackers. Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems.
  • Mon 15 Sep, 02:16 UTC. SecurityOnline. China-Aligned Hackers Unleash Upgraded Toneshell and New USB Worm.
  • Mon 15 Sep, 19:10 UTC. The Hacker News, its first report on the story. Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs.
  • Tue 16 Sep, 08:16 UTC. Security Affairs. China-linked Mustang Panda deploys advanced SnakeDisk USB worm.
  • Wed 24 Sep, 21:35 UTC. Unit 42, its first report on the story. Bookworm to Stately Taurus Using the Unit 42 Attribution Framework.
  • Tue 7 Oct, 06:35 UTC. GBHackers. Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware.
  • Wed 8 Oct, 03:31 UTC. SecurityOnline. Mustang Panda APT Uses Hidden DLL and EnumFontsW to Launch Stealthy Tibet-Themed Campaign.
  • Fri 31 Oct, 20:25 UTC. Dark Reading, its first report on the story. UNC6384 Targets European Diplomatic Entities With Windows Exploit.
  • Sat 1 Nov, 14:30 UTC. Security Affairs. China-linked UNC6384 exploits Windows zero-day to spy on European diplomats.
  • Mon 3 Nov, 02:41 UTC. SecurityOnline. Chinese APT UNC6384 Pivots to Europe, Exploits Windows LNK Flaw to Deploy PlugX via Canon DLL Sideloading.
  • Mon 29 Dec, 10:10 UTC. Securelist, its first report on the story. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor.
  • Tue 30 Dec, 09:05 UTC. The Hacker News. Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor.
  • Tue 30 Dec, 10:15 UTC. SecurityWeek, its first report on the story. Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit.
  • Tue 30 Dec, 16:15 UTC. Security Affairs. Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver.
  • Thu 1 Jan, 01:21 UTC. SecurityOnline. The Ghost in the Kernel: How HoneyMyte Weaponized a Rootkit to Hijack Asian Governments.
  • Tue 13 Jan, 08:41 UTC. trendmicro.com, its first report on the story. Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™.
  • Mon 19 Jan, 00:50 UTC. SecurityOnline. New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign.
  • Tue 27 Jan, 08:30 UTC. Securelist. HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns.
  • Wed 28 Jan, 01:35 UTC. SecurityOnline. HoneyMyte Evolved: Spies Use Pixeldrain & CoolClient for Real-Time Surveillance.
  • Wed 28 Jan, 13:30 UTC. The Hacker News. Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks.
  • Wed 1 Apr, 12:44 UTC. Infosecurity, its first report on the story. Chinese Hackers Target European Governments in Espionage Campaigns.
  • Fri 3 Apr, 18:11 UTC. The Hacker News. China linked TA416 revives EU govt espionage using cloud PlugX.
  • Tue 21 Apr, 12:32 UTC. Dark Reading. Mustang Panda hits Indian banks with LotusLite backdoor.
  • Wed 22 Apr, 08:41 UTC. The Hacker News. Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 14 May, 15:10 UTC. Infosecurity. FDMTP backdoor v3.2 update tied to Mustang Panda espionage.
  • Mon 29 Jun, 16:48 UTC. The Hacker News. Mustang Panda leverages Zoho WorkDrive against Indian government.
  • Thu 2 Jul, 08:41 UTC. SecurityOnline. Mustang Panda spies on India using Zoho WorkDrive for hydropower.
  • Fri 7 Aug, 08:31 UTC. SecurityOnline. Supply chain attack hijacks QuickFox, targets Chinese students.
  • Fri 14 Aug, 09:26 UTC. Securelist. HoneyMyte APT's CoolClient backdoor gains kernel stealth driver.
  • Sun 16 Aug, 17:31 UTC. Security Affairs. Mustang Panda's CoolClient gains signed driver for stealth.
  • Wed 19 Aug, 10:22 UTC. SecurityOnline. HoneyMyte updates CoolClient rootkit to spy on Asian, Russian govt.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. Google Says AI Is Accelerating Supply Chain and Cloud Attacks. This article, 39th of 39.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 39 articles as a list
  1. Tue 26 AugDay 03
    1. Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection12:25 · GBHackers · First report
    2. China-Based Threat Actor Mustang Panda’s TTPs Leaked19:11 · GBHackers
    3. Silk Typhoon hackers hijack network captive portals in diplomat attacks23:15 · BleepingComputer
  2. Wed 27 AugDay 12
    1. Google Threat Intelligence Exposes UNC6384’s Stealthy Espionage Campaign03:30 · SecurityOnline
    2. China linked Silk Typhoon targeted diplomats by hijacking web traffic09:45 · Security Affairs

  3. Quiet for 2 weeks

    Fri 12 SepDay 171
    1. ToneShell Backdoor Evolves With Anti-Analysis Tricks, Continues Targeting Myanmar00:30 · SecurityOnline · Picked up again

  4. Quiet for 2 days

    Sat 13 SepDay 181
    1. Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems18:51 · GBHackers
  5. Mon 15 SepDay 202
    1. China-Aligned Hackers Unleash Upgraded Toneshell and New USB Worm02:16 · SecurityOnline
    2. Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs19:10 · The Hacker News
  6. Tue 16 SepDay 211
    1. China-linked Mustang Panda deploys advanced SnakeDisk USB worm08:16 · Security Affairs

  7. Quiet for 9 days

    Wed 24 SepDay 291
    1. Bookworm to Stately Taurus Using the Unit 42 Attribution Framework21:35 · Unit 42 · Picked up again

  8. Quiet for 12 days

    Tue 7 OctDay 421
    1. Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware06:35 · GBHackers · Picked up again
  9. Wed 8 OctDay 431
    1. Mustang Panda APT Uses Hidden DLL and EnumFontsW to Launch Stealthy Tibet-Themed Campaign03:31 · SecurityOnline

  10. Quiet for 3 weeks

    Fri 31 OctDay 661
    1. UNC6384 Targets European Diplomatic Entities With Windows Exploit20:25 · Dark Reading · Picked up again
  11. Sat 1 NovDay 671
    1. China-linked UNC6384 exploits Windows zero-day to spy on European diplomats14:30 · Security Affairs

  12. Quiet for 2 days

    Mon 3 NovDay 691
    1. Chinese APT UNC6384 Pivots to Europe, Exploits Windows LNK Flaw to Deploy PlugX via Canon DLL Sideloading02:41 · SecurityOnline

  13. Quiet for 8 weeks

    Mon 29 DecDay 1251
    1. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor10:10 · Securelist · Picked up again
  14. Tue 30 DecDay 1263
    1. Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor09:05 · The Hacker News
    2. Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit10:15 · SecurityWeek
    3. Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver16:15 · Security Affairs
  15. Thu 1 JanDay 1281
    1. The Ghost in the Kernel: How HoneyMyte Weaponized a Rootkit to Hijack Asian Governments01:21 · SecurityOnline

  16. Quiet for 12 days

    Tue 13 JanDay 1401
    1. Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™08:41 · trendmicro.com · Picked up again

  17. Quiet for 6 days

    Mon 19 JanDay 1461
    1. New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign00:50 · SecurityOnline · Picked up again

  18. Quiet for 8 days

    Tue 27 JanDay 1541
    1. HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns08:30 · Securelist · Picked up again
  19. Wed 28 JanDay 1552
    1. HoneyMyte Evolved: Spies Use Pixeldrain & CoolClient for Real-Time Surveillance01:35 · SecurityOnline
    2. Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks13:30 · The Hacker News

  20. Quiet for 9 weeks

    Wed 1 AprDay 2181
    1. Chinese Hackers Target European Governments in Espionage Campaigns12:44 · Infosecurity · Picked up again

  21. Quiet for 2 days

    Fri 3 AprDay 2201
    1. China linked TA416 revives EU govt espionage using cloud PlugX18:11 · The Hacker News · Picked up again

  22. Quiet for 3 weeks

    Tue 21 AprDay 2381
    1. Mustang Panda hits Indian banks with LotusLite backdoor12:32 · Dark Reading · Picked up again
  23. Wed 22 AprDay 2391
    1. Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles08:41 · The Hacker News

  24. Quiet for 3 weeks

    Thu 14 MayDay 2612
    1. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit12:30 · SecurityWeek · Picked up again
    2. FDMTP backdoor v3.2 update tied to Mustang Panda espionage15:10 · Infosecurity

  25. Quiet for 7 weeks

    Mon 29 JunDay 3071
    1. Mustang Panda leverages Zoho WorkDrive against Indian government16:48 · The Hacker News · Picked up again

  26. Quiet for 3 days

    Thu 2 JulDay 3101
    1. Mustang Panda spies on India using Zoho WorkDrive for hydropower08:41 · SecurityOnline · Picked up again

  27. Quiet for 5 weeks

    Fri 7 AugDay 3461
    1. Supply chain attack hijacks QuickFox, targets Chinese students08:31 · SecurityOnline · Picked up again

  28. Quiet for 7 days

    Fri 14 AugDay 3531
    1. HoneyMyte APT's CoolClient backdoor gains kernel stealth driver09:26 · Securelist · Picked up again

  29. Quiet for 2 days

    Sun 16 AugDay 3551
    1. Mustang Panda's CoolClient gains signed driver for stealth17:31 · Security Affairs · Picked up again

  30. Quiet for 3 days

    Wed 19 AugDay 3581
    1. HoneyMyte updates CoolClient rootkit to spy on Asian, Russian govt10:22 · SecurityOnline · Picked up again

  31. Quiet for 4 weeks

    Mon 14 SepDay 3841
    1. Google Says AI Is Accelerating Supply Chain and Cloud Attacks03:11 · SecurityOnline · Picked up again · This article, 39th of 39

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in