Chinese Hackers Use Rootkit to Hide ToneShell Malware Activity

A Chinese-linked APT known as HoneyMyte (Mustang Panda / Bronze President) is deploying a stolen-code-signed kernel mini-filter driver (ProjectConfiguration.sys) as a rootkit to inject and conceal the ToneShell backdoor on Windows systems, primarily targeting government networks across Southeast and East Asia for long-term espionage. The driver hides files and processes, hooks file and registry operations to return access-denied at kernel level, alters Microsoft Defender filter altitude to intercept security operations, and enables ToneShell to communicate with C2 servers over raw TCP port 443 using a simple TLS-like header and XOR-encrypted payloads.