{"id":783,"date":"2025-09-15T11:48:52","date_gmt":"2025-09-15T09:48:52","guid":{"rendered":"https:\/\/familiebuckens.nl\/?p=783"},"modified":"2025-09-18T11:49:52","modified_gmt":"2025-09-18T09:49:52","slug":"mustang-panda-deploys-snakedisk-usb-worm-to-deliver-yokai-backdoor-on-thailand-ips","status":"publish","type":"post","link":"https:\/\/familiebuckens.nl\/index.php\/2025\/09\/15\/mustang-panda-deploys-snakedisk-usb-worm-to-deliver-yokai-backdoor-on-thailand-ips\/","title":{"rendered":"Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The China-aligned threat actor known as&nbsp;<strong><a href=\"https:\/\/thehackernews.com\/2025\/06\/pubload-and-pubshell-malware-used-in.html\" rel=\"noreferrer noopener\" target=\"_blank\">Mustang Panda<\/a><\/strong>&nbsp;has been observed using an updated version of a backdoor called TONESHELL and a previously undocumented USB worm called SnakeDisk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;The worm only executes on devices with Thailand-based IP addresses and drops the&nbsp;<a href=\"https:\/\/thehackernews.com\/2024\/12\/thai-officials-targeted-in-yokai.html\" rel=\"noreferrer noopener\" target=\"_blank\">Yokai<\/a>&nbsp;backdoor,&#8221; IBM X-Force researchers Golo M\u00fchr and Joshua Chung&nbsp;<a href=\"https:\/\/www.ibm.com\/think\/x-force\/hive0154-drops-updated-toneshell-backdoor\" rel=\"noreferrer noopener\" target=\"_blank\">said<\/a>&nbsp;in an analysis published last week.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The tech giant&#8217;s cybersecurity division is tracking the cluster under the name Hive0154, which is also broadly referred to as BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, Polaris, RedDelta, Stately Taurus, and Twill Typhoon. The state-sponsored threat actor is believed to have been active since at least 2012.<\/p>\n\n\n<a class=\"wp-block-read-more\" href=\"https:\/\/familiebuckens.nl\/index.php\/2025\/09\/15\/mustang-panda-deploys-snakedisk-usb-worm-to-deliver-yokai-backdoor-on-thailand-ips\/\" target=\"_self\"><a href=\"https:\/\/thehackernews.com\/2025\/09\/mustang-panda-deploys-snakedisk-usb.html\">Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs<\/a><span class=\"screen-reader-text\">: Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs<\/span><\/a>","protected":false},"excerpt":{"rendered":"<p>The China-aligned threat actor known as&nbsp;Mustang Panda&nbsp;has been observed using an updated version of a backdoor called TONESHELL and a previously undocumented USB worm called SnakeDisk. &#8220;The worm only executes on devices with Thailand-based IP addresses and drops the&nbsp;Yokai&nbsp;backdoor,&#8221; IBM X-Force researchers Golo M\u00fchr and Joshua Chung&nbsp;said&nbsp;in an analysis published&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,17],"tags":[40],"class_list":["post-783","post","type-post","status-publish","format-standard","hentry","category-malware","category-vulnerability","tag-40"],"_links":{"self":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/comments?post=783"}],"version-history":[{"count":1,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/783\/revisions"}],"predecessor-version":[{"id":784,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/783\/revisions\/784"}],"wp:attachment":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/media?parent=783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/categories?post=783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/tags?post=783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}