> Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
[AUTHOR: Ionut Arghire]
[DATE: 30/12/2025 10:08]
[LANGUAGE: EN]
The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.
The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek.