Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor post, december 30, 2025januari 5, 2026 The Chinese hacking group known as Mustang Panda (aka HoneyMyte) has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia. The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group targeting government organizations in Southeast and East Asia, primarily Myanmar and Thailand. Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor malware 2025