Chinese state hackers use rootkit to hide ToneShell malware activity

Kaspersky analyzed a new ToneShell backdoor sample used in Mustang Panda campaigns that is delivered via a signed kernel‑mode mini‑filter driver (ProjectConfiguration.sys) acting as a rootkit to hide activity and inject user‑mode payloads; the variant adds network obfuscation, a new host ID scheme, and remote file/shell capabilities, and has been observed in attacks against government organizations in Myanmar, Thailand and other Asian countries since at least February 2025, with a short IoC list provided.