Sign in Subscribe

Mustang Panda

Mustang Panda (Bronze President, HoneyMyte) is a China-linked espionage group targeting government and defense entities across Asia and Europe using custom backdoors including PlugX, ToneShell, and CoolClient.

Trending Topics

Trending Topics

GlassWorm supply chain attack hits Open VSX via a compromised publisher account. ClawHavoc floods the OpenClaw marketplace with 341 malicious skills. Mustang Panda (HoneyMyte, Bronze President) expands its CoolClient backdoor across Asia. Anatsa banking trojan found on Google Play.

Trending Topics

Trending Topics

GitHub repo-forking abuses trusted installer paths to spread malware. Operation Bizarre Bazaar hijacks exposed LLM infrastructure at scale. Mustang Panda upgrades its CoolClient backdoor with deeper credential theft across Southeast Asia.

Trending Topics

ToneShell Backdoor

Trending Topics

HoneyMyte (Mustang Panda) deploys a kernel-mode rootkit to hide its ToneShell backdoor. Microsoft Copilot Studio's Connected Agents feature allows silent privilege escalation between AI agents. EmEditor supply chain attack delivers a multi-stage infostealer via trojanized installers.

Trending Topics

SafePay Ransomware

Trending Topics

SafePay claims the Ingram Micro breach. Mustang Panda hits maritime shipping firms via USB malware. ShinyHunters, overlapping with Scattered Spider (UNC3944), exploits Salesforce via vishing. APT28 deploys AI-powered LameHug malware.

Monthly Wrap - March 2025

State Sponsored

Monthly Wrap - March 2025

Lazarus Group uses CAPTCHA phishing and Lumma Stealer to hit crypto wallets. APT41 exploits Check Point VPN flaw to deploy ShadowPad. LockBit hits Confluence CVE-2023-22527 for fast ransomware deployment. Mustang Panda and Kimsuky continue espionage campaigns.

Monthly Wrap - February 2025

State Sponsored

Monthly Wrap - February 2025

February 2025 wrap: Vo1d botnet compromises 1.5M Android TVs. Lazarus Group and Mustang Panda continue espionage campaigns. Sandworm (APT44) targets Ukraine via fake Windows activators. LockBit and Cl0p exploit zero-days.