Executive Summary

The China-linked cyber-espionage group Mustang Panda (also known as HoneyMyte or Earth Preta) has incorporated a new, sophisticated tool into its arsenal: a kernel-mode rootkit used to stealthily load its TONESHELL backdoor. According to research from Kaspersky, the rootkit is a driver file named ProjectConfiguration.sys that has been signed with a valid, albeit leaked, digital certificate from a Chinese ATM provider. This allows it to load into the Windows kernel without raising alarms. Once active, the rootkit functions as a minifilter driver, giving it the power to hide the presence of the TONESHELL malware from security tools and investigators. This marks a significant evolution in the group's tradecraft, enabling deeper, more persistent, and harder-to-detect intrusions into target networks, primarily government entities in Southeast Asia.

Threat Overview

Mustang Panda is a well-known APT group with a history of targeting government, non-profit, and other strategic organizations, particularly in Asia. This latest campaign, observed in mid-2025, demonstrates a clear investment in enhancing their operational security and stealth.

• Threat Actor: Mustang Panda, a group linked to Chinese state interests.
• Targets: Government organizations in Southeast Asia, specifically Myanmar and Thailand.
• New Tool: A kernel-mode rootkit (ProjectConfiguration.sys) that provides stealth and persistence.
• Payload: The TONESHELL backdoor, a known malware used by the group for reverse shell and downloader capabilities.

Technical Analysis

The core of this new TTP is the use of a signed rootkit to achieve unparalleled stealth.

1. Initial Access: The exact initial access vector is unconfirmed, but it is suspected that the attackers used previously compromised machines to deploy the new rootkit.
2. Rootkit Deployment: The driver file ProjectConfiguration.sys is dropped and loaded onto the system. It is signed with a leaked certificate from Guangzhou Kingteller Technology Co., Ltd., which allows it to bypass Windows driver signature enforcement.
3. Kernel-Mode Execution: The driver registers itself as a minifilter driver, operating in kernel mode (T1014 - Rootkit). This gives it high-level privileges and the ability to intercept and modify system operations.
4. Defense Evasion: The rootkit's primary function is to hide malicious artifacts. It protects the TONESHELL backdoor's files, processes, and registry keys, making them invisible to user-mode applications like Task Manager, File Explorer, and most endpoint security products.
5. Payload Injection: The rootkit injects the TONESHELL shellcode directly into the memory of a legitimate system process, such as svchost.exe (T1055 - Process Injection). This in-memory execution further evades disk-based scanning.
6. Command and Control: The TONESHELL backdoor then establishes a reverse shell to an attacker-controlled C2 server, allowing for remote access and the downloading of additional malware.

MITRE ATT&CK Techniques Observed

Impact Assessment

The use of a signed kernel-mode rootkit represents a significant escalation in Mustang Panda's capabilities. This technique makes detection extremely difficult, allowing the threat actor to maintain long-term, undetected access to highly sensitive government networks. This level of persistence enables deep espionage, exfiltration of state secrets, and the potential to use the compromised networks as a launchpad for future attacks. The abuse of a legitimate digital certificate also erodes trust in the code-signing ecosystem.

Cyber Observables for Detection

Detection & Response

• Memory Analysis: Detecting this threat requires advanced techniques. Live memory analysis of compromised systems may reveal the injected TONESHELL code within svchost.exe or other processes. This aligns with D3FEND's D3-DA: Dynamic Analysis.
• Driver Monitoring: Use tools that can inspect loaded kernel drivers. Look for the presence of ProjectConfiguration.sys or any drivers signed by Guangzhou Kingteller Technology Co., Ltd. that are not expected in your environment.
• Certificate Revocation: Ensure systems are configured to check for certificate revocation. The leaked certificate should be added to an enterprise blocklist.
• Network Behavior Analysis: Even if the malware is hidden on the host, its C2 traffic may be detectable. Monitor for unusual, periodic connections from sensitive systems to external IP addresses. This is a form of D3FEND's D3-NTA: Network Traffic Analysis.

Mitigation

• Application Control / Driver Control: Implement strict policies that prevent the loading of unauthorized or untrusted drivers. While this driver is signed, it can be blocklisted by its hash or signer. This is a form of D3FEND's D3-DLIC: Driver Load Integrity Checking.
• Hypervisor-Based Security: Consider solutions that leverage virtualization to monitor the operating system from a higher privilege level (the hypervisor). These tools can be more effective at detecting kernel-level manipulation.
• Reduce Privileges: Enforce the principle of least privilege. The initial deployment of the rootkit likely required administrative privileges. Limiting these privileges can prevent the attack from succeeding in the first place.