Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems

IBM X-Force researchers have uncovered sophisticated new malware campaigns orchestrated by the China-aligned threat actor Hive0154, also known as Mustang Panda.

The discovery includes an advanced Toneshell backdoor variant that evades detection systems and a novel USB worm called SnakeDisk specifically targeting Thailand-based devices.

Enhanced Toneshell Backdoor Evades Detection

The latest iteration of Toneshell, dubbed Toneshell9, represents a significant advancement in the threat actor’s capabilities.

This updated variant introduces proxy communication features that allow the malware to blend seamlessly with legitimate enterprise network traffic by utilizing locally configured proxy servers.

Key Technical Features:

• Dual reverse shell functionality enabling simultaneous command execution streams.
• Proxy-aware communication to bypass enterprise egress filtering.
• Enhanced evasion techniques including junk code injection with ChatGPT-sourced strings.
• Custom encryption methods using modified pseudo-random number generators.

Toneshell9 establishes persistence through DLL sideloading techniques and maintains command-and-control communication by disguising traffic as TLS 1.2 Application Data packets.

The malware creates a sophisticated client object capable of managing multiple C2 servers, proxy configurations, and encryption keys simultaneously.

Its ability to enumerate Windows registry hives for proxy settings demonstrates the group’s deep understanding of enterprise network architectures.

SnakeDisk Worm Hits Thailand

The newly identified SnakeDisk USB worm showcases Hive0154’s targeted approach to cyber espionage operations.

This malware specifically checks for Thailand-based IP addresses before executing, suggesting a strategic focus on Thai government and organizational networks during heightened regional tensions.

Operational Characteristics:

• Geolocation-based execution limited to Thailand IP addresses.
• USB propagation mechanism infecting removable storage devices.
• Yokai backdoor deployment establishing persistent remote access.
• File hiding capabilities masking legitimate USB contents to avoid detection.

The timing of SnakeDisk’s deployment coincides with escalating Thailand-Cambodia border disputes and diplomatic tensions throughout 2025.

The worm’s sophisticated USB infection mechanism suggests attempts to penetrate air-gapped systems commonly employed in sensitive government environments.

When triggered, SnakeDisk drops the Yokai backdoor, previously linked to campaigns against Thai officials in December 2024.

Expanding Chinese Cyber Operations

Security researchers attribute this activity to Hive0154, a well-established China-aligned threat group that operates multiple subclusters targeting government agencies, think tanks, and private organizations across East Asia.

The group’s arsenal includes numerous custom malware loaders, backdoors, and USB worm families, demonstrating advanced development capabilities.

The discovery of weaponized archives uploaded from Singapore and Thailand throughout mid-2025 indicates sustained targeting of Southeast Asian entities.

These campaigns have utilized social engineering lures impersonating government communications, including fake Myanmar Ministry of Foreign Affairs documents distributed through cloud storage platforms like Box and Google Drive.

IBM X-Force assesses that China’s strategic interests in the region, particularly regarding Cambodia as a key ally, may have provided motivation for intensified operations against Thailand.

The deployment of geographically-restricted malware suggests a calculated approach to intelligence collection during a period of regional instability.

Organizations in the targeted regions should implement enhanced security measures including monitoring for suspicious USB devices, detecting TLS traffic without proper handshakes, and scrutinizing cloud storage download links in official communications.

The sophisticated nature of these tools indicates Hive0154’s continued evolution as a significant cyber threat to regional stability and organizational security.

Indicators of Compromise (IoCs):

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.