Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

The SecurityWeek piece reports that the Chinese APT Mustang Panda, also known as Basin, Bronze President, Earth Preta, Red Delta and HoneyMyte, has been observed using a kernel-mode rootkit in attacks against Asian targets, with findings attributed to Kaspersky.

According to Kaspersky, in mid-2025 the group was seen deploying a signed driver that registers as a mini-filter driver to deploy the ToneShell backdoor, and it contains two user-mode shellcodes executed as separate threads to protect the driver’s module and the backdoored process. The driver’s techniques include dynamic resolution of API addresses from hash values to obfuscate behaviour, registering with the Filter Manager, and setting a pre-operation callback to deny security tools from removing it.

It also builds a list of registry paths, assigns an altitude value to sit above certain security components, and monitors registry operations to block targeted keys, thereby evading protection. The backdoor delivered two user-mode payloads, with the first spawning a svchost process and injecting delay-inducing shellcode, and the second delivering ToneShell into the spawned process, providing kernel-mode protection from user-mode monitoring. The report notes this marks the first observed delivery of ToneShell via a kernel-mode loader, enhancing the rootkit’s stealth.