Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs

According to IBM X-Force researchers Golo Mühr and Joshua Chung, the China-aligned threat actor Mustang Panda has been observed deploying an updated version of the TONESHELL backdoor alongside a previously undocumented USB worm called SnakeDisk. The SnakeDisk worm is geofenced to execute only on devices with Thailand-based IP addresses and drops Yokai, a backdoor that sets up a reverse shell to run arbitrary commands.

The operation uses DLL side-loading to deliver these payloads, with TONESHHELL variants such as TONESHELL8 and TONESHELL9 supporting two active reverse shells and C2 communications via locally configured proxies. SnakeDisk is described as a USB-worm framework that propagates by moving files on a USB into a new sub-directory and disguising the payload as a USB.exe, yet it primarily serves to deploy Yokai on Thai targets.

IBM X-Force notes that Yokai shows overlaps with other Hive0154 families, and that Mustang Panda’s Thai-focused activity underscores an evolving malware ecosystem within this cluster. The analysis, published recently, places the activity within Hive0154, the group also referred to by several other names and reportedly active since at least 2012.