Mustang Panda's Latest Cyber Espionage Campaign: New Tools and Tactics

Mustang Panda's Evolving Cyber Espionage

• 🎯 Mustang Panda, a Chinese-origin threat group, traditionally targets government, military, and minority groups, primarily in East Asia, but has recently expanded its reach to Europe.
• 🔍 This discussion focuses on their latest campaign, initiated by the discovery of new tools and updated backdoors used against machines in the Myanmar region.

New Tools and Backdoors

• 🚪 Tone Shell is an updated backdoor with enhanced stealth capabilities, featuring modified command and control communication protocols using fake TLS headers and new methods for storing infected machine identifiers.
• 📡 Star Proxy is a newly discovered lateral movement tool that leverages the VTLS protocol to proxy traffic, enabling attackers to propagate through an environment and access harder-to-reach adjacent devices.
• 🔑 Two custom keyloggers, PAKLOG and CorKLOG, have been identified, along with SplatCloak, an EDR evasion tool designed to disable certain EDR functionalities.

Evasion and Stealth Techniques

• 🎭 Fake TLS traffic imitation is used to disguise command and control protocols and evade detection engines that rely on pattern-based fingerprinting.
• 🔒 Custom encryption methods are employed to further obscure communication and avoid detection.
• 💉 DLL code injection allows malicious code to run as part of legitimate processes, though this technique is often detectable by EDRs.

Attack Stages and Defense Strategies

• 🗺️ The discussion outlines a four-stage attack model: finding the attack surface, compromising assets, lateral movement, and data exfiltration.
• 🛡️ Defense in depth is crucial, emphasizing the importance of EDR, full TLS inspection at the network layer, proper network segmentation to limit lateral propagation, and inline DLP solutions for inspecting egressing data.
• 💡 While AI is not directly used by Mustang Panda in this campaign, its growing use by threat actors necessitates defenders leveraging AI to fight AI for efficiency and efficacy.

Measuring Success and Sophistication

• 📊 Zscaler's visibility into Mustang Panda's operations comes from their Zero Trust Exchange, utilizing advanced controls like sandboxing, deception technology (honeypots), and payload detonation to detect and thwart attacks.
• 📈 Mustang Panda is considered well-resourced and is continuously improving its tooling and stealth techniques, indicating a rising level of sophistication.