A new variant of the ToneShell backdoor attributed to China-linked Mustang Panda has been discovered targeting Myanmar with enhanced persistence mechanisms and sophisticated anti-analysis techniques.
This lightweight backdoor continues the group’s strategic focus on the Southeast Asian nation, reflecting China’s broader geopolitical interests in the region.
The latest sample, compiled on July 14, 2025, arrives as a DLL named SkinH.dll (SHA256: e7b29611c789a6225aebbc9fee3710a57b51537693cb2ec16e2177c22392b546) within a ZIP archive titled “TNLA and other revolutionary forces” in the Myanmar language.
Security researchers have identified significant tactical evolution in this variant’s approach to persistence and evasion.
Advanced Persistence Through Task Scheduler Exploitation
The most notable enhancement involves sophisticated abuse of Windows Task Scheduler COM services for maintaining persistence.
Upon execution, the backdoor performs an interesting self-protection check by searching for Google Drive paths in its execution environment, potentially to avoid infecting the operators themselves.
The malware implements a robust persistence mechanism by copying itself along with supporting DLLs (msvcr100.dll, msvcp100.dll, mfc100.dll) to a randomly named six-character directory within the user’s AppData folder.
It then leverages the Task Scheduler COM service to create a scheduled task named “dokanctl” that executes every minute, pointing to the backdoor’s new location at %APPDATA%<random-folder>\svchosts.exe.
Sophisticated Anti-Analysis Arsenal
This ToneShell variant employs an extensive array of anti-sandboxing techniques designed to frustrate automated analysis systems.
The malware implements repeated file churn operations, creating and deleting temporary files with Sleep(100) delays to waste execution time.
It utilizes randomized sleep loops, accumulating over 20 seconds of startup delay, and performs tick count checks requiring at least 10 seconds of wall-clock time before proceeding.
Particularly interesting is the malware’s use of large embedded string buffers containing text copied from OpenAI’s blog on image generation and Pega AI’s website.
These strings serve no functional purpose beyond inflating the binary size and providing meaningless content for opaque string comparisons that consume CPU cycles.
The backdoor maintains its custom API-resolving scheme using rolling hash functions to obfuscate imported Windows API calls, making static analysis more challenging.
Network Communication and C2 Infrastructure
ToneShell communicates with its command and control server at 146.70.29[.]229:443 using a TLS-like protocol wrapper. Messages begin with fixed bytes “17 03 03” mimicking TLS 1.2 Application Data, followed by XOR-encoded payloads limited to 255 bytes.
Researchers identified another related variant (SHA256: a58868b3d50b775de99278eeb14da8b7409b165aa45313c6d9fa35ac30d2cda2) compiled in March 2025, demonstrating continued development of this toolset.
The sustained targeting of Myanmar through refined ToneShell variants underscores Mustang Panda’s commitment to maintaining cyber operations in strategically significant regions, highlighting the intersection of cybersecurity threats and geopolitical objectives.
IOCs
ToneShell variants:
a58868b3d50b775de99278eeb14da8b7409b165aa45313c6d9fa35ac30d2cda2
e7b29611c789a6225aebbc9fee3710a57b51537693cb2ec16e2177c22392b546
Archive files:
543024edc9f160cc1cedcffc3de52bfa656daa0ec9ed351331d97faaa67d0d99
1272a0853651069ed4dc505007e8525f99e1454f9e033bcc2e58d60fdafa4f0
C2:
146.70.29[.]229:443
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
