Mustang Panda: ToneShell and StarProxy
ID: ffdd1fdc-460f-5339-8736-e57c29ecbbfa
STIX ID: report--ffdd1fdc-460f-5339-8736-e57c29ecbbfa
Feed Name: Zscaler Security Research Blog
Threat Score
This report analyzes Mustang Panda tooling, focusing on three ToneShell variants and a newly discovered StarProxy lateral-proxy DLL. It documents archive-based DLL sideloading, GUID and seed generation methods, rolling XOR encryption, FakeTLS header usage (TLSv1.2/v1.3 spoofing), detailed C2 command sets and packet formats, and filenames/paths observed on the group's staging server, highlighting iterative changes intended to evade detection and enable payload execution and lateral movement.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.