Discovering the Innovations of Mustang Panda’s Cyber Threats

In recent developments, the threat group known as Mustang Panda, which is believed to have ties to China, has unveiled new capabilities that have cybersecurity experts on alert. This group is now using an updated version of the TONESHELL backdoor and introducing a new USB worm, SnakeDisk.

Insight into SnakeDisk’s Functionality

According to analysis from IBM X-Force researchers Golo Mühr and Joshua Chung, SnakeDisk is designed to run exclusively on devices with IP addresses based in Thailand. Once activated, this worm deploys the Yokai backdoor, furthering its infiltration capabilities. This specific targeting emphasizes the group’s focus on Thailand and raises concerns regarding potential security risks in that region.

IBM X-Force categorizes this activity under the cluster name Hive0154, which is also recognized by several other names including BASIN, Bronze President, and RedDelta. Observations suggest that this state-sponsored group has been operational since at least 2012, indicating a longstanding presence in the cyber landscape.

TONESHELL Updated Variants

TONESHELL is not a new term in the cybersecurity realm; it was initially identified by Trend Micro in November 2022. Originally associated with attacks against countries like Myanmar, Australia, the Philippines, Japan, and Taiwan, TONESHELL uses DLL side-loading techniques to activate its payloads. This tool’s primary purpose is to fetch subsequent malicious payloads once it infiltrates a system.

Recently, TONESHELL variants have emerged, specifically TONESHELL8 and TONESHELL9. These make advancements in communication by utilizing locally configured proxy servers. This function helps the malware blend in with legitimate enterprise network activity and enables it to maintain two active reverse shells simultaneously. Interestingly, these variants incorporate obfuscation techniques, such as repurposing code from OpenAI’s ChatGPT, to evade detection by traditional security mechanisms.

The Mechanisms of SnakeDisk

Alongside TONESHELL, the introduction of SnakeDisk reveals a deeper layer of strategy. Sharing some characteristics with an existing USB worm framework called TONEDISK, SnakeDisk detects both existing and newly connected USB devices to propagate itself.

The method of operation involves moving files on a USB device into a new subdirectory, tricking users into launching the malware by naming it after the USB drive, for example, "USB.exe." After execution, it transfers the files back into their original locations, gently masking its malicious intent.

Geofencing Techniques in Malware

A notable feature of SnakeDisk is its specific geofencing design, executed only on public IP addresses in Thailand. This targeted approach aligns with past activities linked to the Yokai backdoor, which has been documented in attacks against Thai officials. Researchers have noted that while SnakeDisk and Yokai are different malware types, they exhibit structural and operational similarities, particularly in establishing reverse shell connections to their command-and-control servers.

Implications of Mustang Panda’s Actions

The emergence of these new tools highlights not just the capabilities of Mustang Panda but also points to a specialized subgroup within the larger threat actor network that is honing in on Thailand. This revelation underscores the continual evolution and sophistication of their malware arsenal.

As IBM pointed out, Hive0154 stands out as a formidable threat group, with its various active subclusters and an extensive ecosystem of malware. The consistency in their development cycles and overlapping techniques indicates a deliberate approach to cyber warfare.

In light of these ongoing developments, it is imperative for organizations, especially within targeted regions, to remain vigilant and enhance their cybersecurity measures to mitigate potential risks associated with such advanced threats.