Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

Published:

30 december 2025 om 08:35:00

Alert date:

30 december 2025 om 09:02:13

Source:

thehackernews.com

Operating Systems, Ransomware & Malware, Data Breach & Exfiltration

Chinese threat actor Mustang Panda deployed a previously undocumented kernel-mode rootkit driver to deliver a new variant of the TONESHELL backdoor in cyber espionage campaigns targeting entities in Asia during mid-2025. The attack utilized a signed kernel-mode rootkit to evade detection and establish persistent access. Kaspersky researchers identified this new backdoor variant as part of ongoing espionage operations by the advanced persistent threat group. The use of kernel-mode rootkits represents a sophisticated technique for maintaining stealth and persistence on compromised systems. The campaign demonstrates Mustang Panda's continued evolution of tactics and tools for cyber espionage activities.

Technical details

Mustang Panda deployed a signed kernel-mode rootkit driver (ProjectConfiguration.sys) to load TONESHELL backdoor. The driver is signed with a stolen/leaked certificate from Guangzhou Kingteller Technology Co., Ltd (valid 2012-2015). It registers as a minifilter driver, operates at altitude 330024+ to bypass security filters, and injects backdoor code into system processes. The rootkit protects malicious files, processes, and registry keys while interfering with Windows Defender by setting WdFilter.sys altitude to zero. TONESHELL communicates with C2 servers over TCP port 443 and provides reverse shell, file upload/download, and command execution capabilities.

Mitigation steps:

Use memory forensics to analyze TONESHELL infections as shellcode executes entirely in memory. Detect injected shellcode as a crucial indicator of backdoor presence. Monitor for minifilter drivers operating at unusual altitudes (330024+) and check for modifications to WdFilter.sys altitude values. Implement detection for processes protected by unusual registry callback routines and monitor for suspicious certificate usage from Guangzhou Kingteller Technology Co., Ltd.

Affected products:

Windows Operating System
Microsoft Defender
WdFilter.sys