Two concurrent espionage campaigns by Mustang Panda targeting Indian government and energy-sector organisations, deploying a novel malware suite that includes SHARDLOADER, MINIRECON and ZOHOMURK.
The intrusions, observed in June 2026, focused on hydropower entities and government offices engaged in MOUs with Taiwanese institutions, using geopolitically themed lures and weaponised archives that sideload malicious DLLs via legitimate signed binaries.
Variant v1.0 of SHARDLOADER creates a hidden staging path under C:\ProgramData\IDM\logs, copies the sideload host and malicious DLL there, and reconstructs an obfuscated shellcode payload from fragmented constants in the .rdata section.
This payload is decrypted through a rolling XOR and byte-reordering routine, allocated into executable memory, and invoked via EnumSystemLocalesA callback abuse to launch MINIRECON.
MINIRECON is an evolution of the previously documented Toneshell family. It retains core Toneshell artefacts PEB-walking for API resolution, a characteristic 13131313 hashing multiplier, and a Linear Congruential Generator (LCG)-based session key mechanism while adding WebSocket-over-HTTPS C2 communications implemented with WinHTTP.
According to Acronis TRU, Both campaigns begin with spear-phishing archives containing a signed launcher and a hidden malicious DLL.
When executed, the legitimate executable loads the attacker-controlled DLL via DLL sideloading, enabling SHARDLOADER to establish persistence and stage further payloads.
The implant upgrades to WebSocket mode, disables certificate validation to accept self-signed certs, and includes proxy fallback logic, enabling robust, stealthy command-and-control in enterprise environments.
MINIRECON supports dual reverse shells, file transfer, remote command execution and operator-driven live reconnaissance; Acronis observed operators actively probing victims and attempting to disrupt analysis on sandboxed hosts.
The second campaign’s SHARDLOADER v1.1 drops a different stager: a signed Citrix binary (pcl2bmp.exe) and ctxmui.dll, the latter being ZOHOMURK. ZOHOMURK stands out by abusing Zoho WorkDrive for C2 and exfiltration.
A total of 69 functions reconstruct the payload at runtime, each loading 32 hardcoded 16-byte XMM constants from scattered locations into a temporary buffer before copying them into a heap region.
The implant authenticates to Zoho’s OAuth API using hardcoded credentials, creates per-victim folders (main and an outbox), polls WorkDrive for command files, downloads and decrypts tasks, executes them locally, and uploads results back to the operator’s outbox.
Commands are dispatched via simple opcodes file operations, interactive shell commands and shell teardown and command files are trashed after consumption to reduce traces.
ZOHOMURK also implements timing-based anti-analysis checks, COM-based scheduled-task persistence in v1.1, and a heartbeat loop to recover its WorkDrive channel if operator folders are removed.
TRU links these campaigns to Mustang Panda with high confidence based on shared tradecraft, reuse of Solid PDF Creator as a sideloading host across campaigns, code overlaps with Toneshell/TONESHELL-derived implants, consistent misspellings (for example “RunOnece”) and recurring infrastructure patterns.
Notably, MINIRECON’s WebSocket C2 resolved to couldinstallup[.]com, hosted on IPs within a subnet previously associated with Mustang Panda-related activity.
Acronis collaborated with CERT-In to notify affected parties and redact victim-specific details while sharing indicators of compromise.
Defensive teams should hunt for the described persistence artifacts (Run keys, scheduled tasks named SolidPDFPcl2Bmp), unusual processes invoking EnumSystemLocalesA after RWX memory allocations, DLL sideloading pairs such as Project Proposal.exe + SolidPDFCreator.dll or pcl2bmp.exe + ctxmui.dll, HTTPS traffic to Zoho WorkDrive originating from non-browser processes, and WebSocket connections to suspicious domains.
ZOHOMURK leverages a legitimate cloud platform and MINIRECON uses WebSocket tunnelling with disabled certificate checks, monitoring application-layer behavior and OAuth token usage is critical.
| Filename / Description | SHA256 hash |
|---|---|
| Hydropower Cooperation Project Proposal.zip | cd9397797216fd4c08df324937509124e57258328c8e4c6d795c6a2cd25b69b0 |
| SolidPDFCreator.dll | Ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a |
| Hydropower Cooperation Project Proposal.exe | Fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025 |
| test.doc | 390148f5157c0f6b337ff19d162c3c2ee3e6d782fdfbe11fb1e411c0684fd33b |
| ctxmui.dll – ZOHOMURK Variant 1 | 5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c |
| MOU USI-INDSR TAIWAN.zip | F53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5 |
| SolidPDFCreator.dll (duplicate name) | A43084f5af861f44c75c5273c779cb26d506cab6b51c33746626da504148a4ec |
| ctxmui.dll – ZOHOMURK Variant 2 | F2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…