Loading malware…
ToneShell is a Windows backdoor family associated with the China-aligned espionage group Mustang Panda, also tracked as HoneyMyte, Earth Preta, Hive0154, and Stately Taurus. The malware has evolved through multiple versions and has been used in cyber-espionage operations targeting government and other strategic organizations, particularly in Asia. Later variants and closely related derivatives show continued development focused on stealth, resilient command and control, and operator interactivity.
ToneShell has commonly been delivered through DLL sideloading with legitimate signed executables, including in spearphishing-driven campaigns that used archive-based lures. Reported delivery chains include password-protected archives and decoy documents, after which a benign executable loads a malicious DLL that decrypts or launches the backdoor payload. ToneShell has also been executed via regsvr32 in some observed activity.
The malware family supports persistent remote access and interactive command execution. Documented variants and reworked descendants support reverse shell functionality, file download and related file-transfer operations, proxy-aware communications, and encrypted beaconing designed to blend with normal traffic. Newer variants have used WebSocket-over-HTTPS command and control and have included logic to enumerate local proxy settings and relax certificate validation to maintain connectivity in monitored enterprise environments.
ToneShell development has emphasized defense evasion. Observed variants use API hashing, string construction obfuscation, junk code insertion, and abuse of legitimate executables for sideloading. The family has also checked for security software before or during execution. Some Mustang Panda tooling derived from or related to ToneShell has introduced kernel-mode enhancements, and reporting has noted that later HoneyMyte rootkit-enabled backdoors were comparable to capabilities previously seen with ToneShell.
ToneShell is part of a broader Mustang Panda malware ecosystem that includes PlugX, PubLoad, CoolClient, TONEINS, MINIRECON, and other loaders and backdoors. MINIRECON has been identified as a reworked ToneShell variant, and multiple reports have linked ToneShell infrastructure, code traits, and development artifacts to broader Mustang Panda operations. The family remains notable as a modular espionage backdoor lineage used in long-running state-aligned intrusion campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Details on Exploited Vulnerabilities ... CVE-2021-40444 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve2 = “CVE-2021-40444”
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Kaspersky had separately documented a different HoneyMyte kernel-mode rootkit in December 2025 that was used to load the ToneShell backdoor. The company said the overall design of the new CoolClient driver is comparable to the kernel-mode enhancements seen with ToneShell.
We found connections between ShadowSyndicate infrastructure and Amos Stealer infrastructure (moderate confidence) as well as though with lower confidence, with ToneShell backdoor
We found connections between ShadowSyndicate infrastructure and Amos Stealer infrastructure (moderate confidence) as well as though with lower confidence, with ToneShell backdoor
Family Custom Mustang Panda beacon (cs_djb2 fork – structurally CS-compatible but operator-modified) ... Article Link: [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
This includes an updated Toneshell variant evading detections and supporting several new features... One of the variants evading VirusTotal detections is the latest update "Toneshell9".
Prior research by Trend Micro had identified technical overlaps between TA416 and UNK_SteadySplit, most notably through a UNK_SteadySplit TONESHELL command-and-control (C2) IP address embedded in a filepath within two LNK files used in TA416 campaigns.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
First-run path : drop itself into C:\ProgramData\Dexpot\ (exact filename detailed in companion report), register scheduled task MediumNetMonIt , exit.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The capabilities of ToneShell are designed for cyberespionage that includes: Executing commands
It retains Toneshell fingerprints such as PEB-walking to locate kernel32.dll and the family’s 13131313 API-hashing multiplier... using the native WinHTTP API
Calls EnumSystemLocalesA() with the in-memory blob as the callback target
Victims will receive and interact with a decoy document containing a Google Drive link and a corresponding password instead of an archive download link embedded in the email.
First-run path : drop itself into C:\ProgramData\Dexpot\ (exact filename detailed in companion report), register scheduled task MediumNetMonIt , exit.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
First-run path : drop itself into C:\ProgramData\Dexpot\ (exact filename detailed in companion report), register scheduled task MediumNetMonIt , exit.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service... The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.
Defense Evasion T1027 Obfuscated Files cs_djb2 hash resolution, interleaved char-by-char URL/User-Agent construction, decoded-by-callback shellcode delivery
Defense Evasion T1027.002 Software Packing Position-independent shellcode – no PE headers, opaque to static AV
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
the fake .docx files have XOR-encrypted content to prevent detection
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
Using ASCII or decoded Base64 strings that represent UUID strings. Calling UuidFromStringA to convert the decoded UUIDs to binary data, each of which represents 16 bytes of shellcode.
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
Defense Evasion T1497 Virtualization/Sandbox Evasion xor eax,eax; inc eax; jz exit infinite-loop trick – confuses breakpoint-based debugging
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
MW_CMD_OPEN_SHELL (5) C2 -> beacon cmd.exe stdout stream via pipe drain thread
The capabilities of ToneShell are designed for cyberespionage that includes: ... File system interaction
Defense Evasion T1497 Virtualization/Sandbox Evasion xor eax,eax; inc eax; jz exit infinite-loop trick – confuses breakpoint-based debugging
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Command and Control T1008 Fallback Channels PATH B: HTTP -> proxy -> WebSocket fallback if direct connection fails
For two IPs of the ShadowSyndicate infrastructure, we found Cobalt strike beacons at the same timeframe that were linked to the Citrix bleed exploit attack campaign where Lockbit ransomware was chiefly deployed by affiliates.
MINIRECON is a reworked variant of the Toneshell backdoor, previously documented by IBM X-Force. It communicates with attacker servers over a WebSocket connection on HTTPS, making it harder to detect through standard network monitoring.
The most recent Pubload variant has undergone minor changes and now supports decoy C2 servers and downloading shellcode payloads via HTTP POST in addition to raw TCP imitating TLS traffic.
The first request that the binary sends is: hxxps://datasmetrics.]com/files/Loader_TM.dll that should deliver a second stage.
129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
88 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware/backdoor whose kernel-mode enhancements are comparable to those seen in the latest CoolClient variant.
Malware / Outils # CoolClient (backdoor) PlugX (rat) msagent.sys (other) ToneShell (backdoor)
A backdoor previously loaded by a different HoneyMyte kernel-mode rootkit; mentioned here for comparison with CoolClient’s kernel-mode enhancements.
Referenced as another HoneyMyte-associated malware previously observed with kernel-mode enhancements similar to those now added to CoolClient.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.