pyaeheinnkyaw.comPublished
Red Shadows over Yangon: Analyzing TONESHELL Malware from Mustang Panda’s Campaign Against Myanmar
By Pyae Heinn Kyaw
Excerpt
Date: 07 Sept 2025
Executive Summary
This report details a targeted malware campaign attributed to Mustang Panda, a Chinese APT group, leveraging a supposed compromised Myanmar embassy email to deliver malware against Myanmar’s entities. The campaign begins with a phishing email containing a seemingly benign PDF attachment. While the PDF itself is not malicious, it contains an embedded URL that leads to the download of a compressed archive ( Call Notes.zip ). Inside the archive are two files:
Call Notes.exe and SolidPDFCreator.dll .
The Call Notes.exe binary em…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by pyaeheinnkyaw.com on pyaeheinnkyaw.com.
Mentioned in the excerpt
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
