Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver

China-linked APT Mustang Panda was observed using a signed kernel-mode rootkit driver with embedded shellcode to load ToneShell backdoor, marking the first observed delivery of ToneShell via a kernel-mode loader. The malicious driver, named ProjectConfiguration.sys, installs as a kernel mini-filter and contains two user-mode shellcodes that execute in separate threads, dynamically resolving Windows APIs using hashed values to hide activity and injecting the ToneShell payload into system processes.

It protects injected processes by blocking file deletions or renames and by safeguarding certain registry keys, and it deliberately uses a high filter altitude to intercept operations before antivirus drivers, even disabling Microsoft Defender’s WdFilter. The final attack stage deploys ToneShell over a C2 channel to servers on port 443, masking traffic with fake TLS 1.3 headers and encrypted payloads.

The researchers assess with high confidence that the activity described is linked to the HoneyMyte threat actor, based on ToneShell as the final payload and other tools associated with HoneyMyte found on impacted systems. The campaign targeted government entities in Southeast and East Asia, especially Myanmar and Thailand, with attacks likely starting in February 2025.