Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware

In April 2026 Cato CTRL detected and blocked an attempted intrusion against a global manufacturer's environment that deployed a customized Go-based implant called TencShell (derived from the Rshell framework). The report documents a staged infection chain—first-stage dropper, Donut shellcode delivered via a masqueraded .woff resource, reflective in-memory PE loading, and web-like Tencent-imitating C2—followed by analysis of capabilities (remote shell, in-memory execution, SOCKS5 proxying, screen control, persistence via Run key), extensive IOCs (IP, domain, hashes), and MITRE ATT&CK mappings; attribution is suspected China-linked but not conclusive.