China-linked Mustang Panda deploys advanced SnakeDisk USB worm

China-linked Mustang Panda has been spotted deploying a new USB worm named SnakeDisk alongside an updated backdoor in its arsenal, according to Security Affairs. The campaign combines SnakeDisk with a newer version of the TONESHELL backdoor and the Yokai backdoor, a payload chain that drops on infected hosts and opens a reverse shell for operators.

IBM X-Force observed that SnakeDisk is designed to spread via weaponised USB drives and to drop the Yokai backdoor, with the SnakeDisk artefact first described as targeting devices in Thailand and using a 32-bit DLL named “01.dat.” The analysis notes that the weaponised workflow includes DLL sideloading, two execution modes, and a two-phase XOR decryption routine, with the Yokai backdoor enabling a persistent, encrypted C2 communications channel and a reverse shell.

The researchers emphasise that Mustang Panda remains highly capable and that Hive0154 subclusters continue to refine their malware, with SnakeDisk being part of potential wavefronts tied to Thailand-targeted campaigns.