Mustang Panda Campaigns Target Indian Government and Energy Sectors With New Malware
Summary
Acronis researchers detail two Mustang Panda campaigns targeting Indian government and hydropower entities with SHARDLOADER, MINIRECON and ZOHOMURK, which uses Zoho WorkDrive for command-and-control and data exfiltration.
Key points
- The campaigns used spear-phishing archives with government- or hydropower-themed lures to deliver malicious DLLs through DLL sideloading.
- SHARDLOADER established persistence and deployed MINIRECON, a Toneshell-derived implant, or ZOHOMURK.
- MINIRECON used HTTPS WebSockets for command-and-control, with proxy fallback and capabilities including remote shells, file transfer and command execution.
- ZOHOMURK abused Zoho WorkDrive for command delivery, command-and-control, and exfiltration of results.
- Acronis identified active beaconing from multiple compromised Indian government systems between June 12 and June 22, 2026.
- Researchers assessed with high confidence that the campaigns were Mustang Panda operations and collaborated with CERT-In on victim notification and mitigation.
Article Details
- Attack Vectors
- The campaigns used hydropower- and government-themed lure documents in compressed archives, reportedly distributed via spear-phishing.
- SHARDLOADER used DLL sideloading through legitimate signed executables, including Solid PDF Creator and Citrix Receiver binaries.
- SHARDLOADER established persistence through Windows Run keys; another variant also registered a recurring Task Scheduler task.
- MINIRECON communicated with C2 over WebSocket on HTTPS, while ZOHOMURK used Zoho WorkDrive for command delivery, remote task execution, and data exfiltration.
- ZOHOMURK supported file operations and interactive shell access; MINIRECON supported reverse shells, file transfer, and remote command execution.
- Defensive Notes
- Monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run for MediumNetMonIt, MicrosoftEdgeUpdateBrokerTask, and ZohoUsingUpdataAnyssAll_RunOnece.
- Hunt for the SolidPDFPcl2Bmp scheduled task and its Pcl2BmpDailyTrigger, configured to repeat every five minutes.
- Check for the reported named events, staging directories, and files, including uydgcfteionxcfd, Local\MS_Edge_Update_Task_Service_Sync, C:\ProgramData\IDM\logs\, and C:\Users\Public\Documents\pcl2bmp.exe with ctxmui.dll.
- Investigate non-browser processes making requests to Zoho WorkDrive or its OAuth endpoint, especially when using the user agents listed in the article.
- Look for the reported sideloading pairs: Project Proposal.exe with SolidPDFCreator.dll, and pcl2bmp.exe with ctxmui.dll.
- The article recommends vigilance against geopolitically themed spear-phishing and monitoring endpoint-driven cloud-service activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | couldinstallup[.]com | MINIRECON WebSocket C2 domain. |
| IPV4 | 188[.]208[.]141[.]177 | IP address resolved by the MINIRECON C2 domain. |
| IPV4 | 188[.]208[.]141[.]196 | Previously identified by IBM X-Force as a Pubload C2 server associated with Hive0154 (Mustang Panda). |
| SHA256 | 390148f5157c0f6b337ff19d162c3c2ee3e6d782fdfbe11fb1e411c0684fd33b | Hash of the malicious test.doc document that drops an earlier ZOHOMURK variant. |
| SHA256 | 5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c | Hash of ctxmui.dll, identified as ZOHOMURK Variant 1. |
| SHA256 | a43084f5af861f44c75c5273c779cb26d506cab6b51c33746626da504148a4ec | Hash of a malicious SolidPDFCreator.dll campaign artifact. |
| SHA256 | cd9397797216fd4c08df324937509124e57258328c8e4c6d795c6a2cd25b69b0 | Hash of the Hydropower Cooperation Project Proposal.zip archive identified as a campaign artifact. |
| SHA256 | ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a | Hash of the malicious SolidPDFCreator.dll identified in the campaign. |
| SHA256 | f2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828 | Hash of ctxmui.dll, identified as ZOHOMURK Variant 2. |
| SHA256 | f53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5 | Hash of the MOU USI-INDSR TAIWAN.zip campaign archive. |
| SHA256 | fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025 | Hash of the Hydropower Cooperation Project Proposal.exe campaign artifact. |
MITRE ATT&CK
T1053.005 · Scheduled TaskA SHARDLOADER variant registered the SolidPDFPcl2Bmp scheduled task with a recurring trigger.T1059.003 · Windows Command ShellZOHOMURK supported interactive shell access by writing operator commands to a shell pipe.T1071.001 · Web ProtocolsMINIRECON used WebSocket over HTTPS for beaconing and command-and-control.T1102.002 · Bidirectional CommunicationZOHOMURK used Zoho WorkDrive as a bidirectional channel for receiving commands and returning results.T1204.002 · Malicious FileThe chain begins when a victim executes Project Proposal.exe from the archive.T1497.003 · Time Based ChecksZOHOMURK used timing checks around a dummy loop to detect analysis or debugging and could terminate execution.T1547.001 · Registry Run Keys / Startup FolderSHARDLOADER and ZOHOMURK established persistence using Windows Run keys.T1566.001 · Spearphishing AttachmentThe archives containing the campaign lures and payloads were believed to have been distributed via spear-phishing.T1567.002 · Exfiltration to Cloud StorageZOHOMURK uploaded command results and exfiltrated data through the operator's Zoho WorkDrive account.T1574.002 · DLL Side-LoadingSHARDLOADER and ZOHOMURK were launched by sideloading malicious DLLs through legitimate executables.T1620 · Reflective Code LoadingSHARDLOADER reconstructed shellcode in memory, allocated and wrote the payload into a buffer, then invoked it through an EnumSystemLocalesA callback.
People
Threat Actors
Malware
MINIRECONMustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECONPubloadwithin the same /24 subnet as 188.208.141.196, an IP address previously identified by IBM X-Force as a Pubload C2 server associated with Hive0154 (Mustang Panda). The shared subnet, hosting provider and autonomousShadowPadPrevious reporting documented the use of ShadowPad in campaigns targeting India's power sector in 2021, highlighting the longstanding interest of China-aligned threat actors in the country's critical infrastructure. TheSHARDLOADERwith Taiwanese government institutions, leveraging a newly discovered malware toolkit comprising SHARDLOADER, MINIRECON and ZOHOMURK. TONESHELLThe campaigns showcase new additions to Mustang Panda's malware arsenal while incorporating code overlaps with previously documented tooling, including TONESHELL. Toneshell8Upon initially looking into the shellcode, we found that it is a variant of Toneshell8, which had been previously reported by researchers at IBM X-Force. While it retains several core characteristics of the malwareZOHOMURKMustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON
Vendors
Products
Acronis EDR / XDRThis threat has been detected and blocked by Acronis EDR / XDR: Citrix Receiverthe implant extracts two embedded files from the .rdata section: pcl2bmp.exe, a legitimate signed Citrix Receiver binary, and ctxmui.dll, a malicious DLL that serves as the ZOHOMURK implant and is sideloaded by theMicrosoft Windowsthe legitimate, digitally signed executable statically imports functions from SolidPDFCreator.dll, Windows automatically loads the attacker-controlled DLL during startup. One of these imported functions,Solid PDF Creatorthe launcher executable revealed that it is a legitimate, digitally signed component of Solid PDF Creator. Its naming convention, delivery method and execution chain closely align with patterns observed inZoho WorkDriveby Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector.
Countries
ChinaMustang Panda has been repeatedly linked in public reporting to China and operations aligned with China's strategic interests. Based on targeting patterns, lure themes, operational characteristics and code overlaps, TRUIndiaMustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECONTaiwanwith intelligence collection related to India's hydropower initiatives and defense cooperation with Taiwan.