The PolySwarm Blog

Verticals Targeted: Government, Military, NGOs
Regions Targeted: Myanmar, East Asia, Europe

Executive Summary

Mustang Panda has enhanced its arsenal with updated ToneShell backdoor variants and a new lateral movement tool, StarProxy, targeting organizations in Myanmar and other regions. These tools employ advanced evasion techniques, including FakeTLS protocols and DLL sideloading, to facilitate espionage.

Verticals Targeted: Telecommunications, Financial, Retail
Regions Targeted: South Korea, Hong Kong, Myanmar, Malaysia, Egypt
Related Families: Symbiote

Executive Summary

A newly discovered BPFDoor controller enhances the backdoor’s stealth, targeting Linux and Solaris systems in Asia and the Middle East. Attributed to Red Menshen, this state-sponsored threat compromises critical sectors with advanced evasion techniques.

Verticals Targeted: Government, Telecommunications, Media, Manufacturing 

Related Families: ValleyRAT
Verticals Targeted: Medical

Executive Summary

Chinese threat actor Silver Fox was recently observed targeting medical devices in a sophisticated campaign that delivers multiple malware families, including ValleyRAT.

Verticals Targeted: Government, Education, Technology, Telecommunications

Executive Summary

Chinese threat actors were recently observed using BadIIS to manipulate SEO and direct victims to illegal gambling sites.

Executive Summary

Related Families: Demodex
Verticals Targeted: Telecommunications 

Executive Summary

Salt Typhoon, a China nexus APT group, was recently observed using GhostSpider backdoor to target telecommunications companies.

Related Families: Macma, Suzafk
Verticals Targeted: NGO

Executive Summary

Evasive Panda recently updated its arsenal to include new TTPs and updated versions of existing malware. They were also observed using a shared framework for malware targeting Windows, Linux, MacOS, and Android systems.