New “TencShell” Malware Weaponizes Open-Source Rshell via Third-Party Access

Cato CTRL intercepted a targeted intrusion that weaponized the open-source Rshell framework into a Go-based implant named TencShell delivered via a Donut dropper hidden as a .woff font; the malware enabled in-memory execution, web-like C2, credential theft and lateral pivoting through third-party access, with suspected (but unconfirmed) China-linked attribution.