Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.

The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek.

Read more: Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

Story added 30. December 2025, content source with full text you can find at link above.