Chinese state hackers use rootkit to hide ToneShell malware activity

Published on December 30, 2025

A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations. [...]

Continue reading on website
Other news

Coupang to split $1.17 billion among 33.7 million data breach victims

December 29, 2025
Coupang, the largest retailer in South Korea, announced $1.17 billion (1.685 trillion Won) total compensation for the 33.7 million customers whose information was exposed in the data breach discovered last month. [...]

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

December 30, 2025
The Chinese hacking group known as Mustang Panda has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia.The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group targeting