China-linked Mustang Panda targeted Indian government and hydropower sectors using Zoho WorkDrive malware in two espionage campaigns. The attacks deployed ZOHOMURK and MINIRECON implants, abusing Zoho WorkDrive as a command-and-control channel. Active compromises were observed between June 12–22, 2026.
Table of Contents
- Introduction: The Mustang Panda Threat
- The Campaigns: Targeting India’s Government and Energy Sectors
- The Malware Toolkit: SHARDLOADER, MINIRECON, and ZOHOMURK
- ZOHOMURK: Weaponizing Zoho WorkDrive for C2
- MINIRECON: The Toneshell Variant with WebSocket C2
- Attribution: Why This Is Mustang Panda with High Confidence
- Indicators of Compromise (IOCs) and Hunting Tips
- Why This Matters for India’s National Security
- Conclusion: Defending Against Cloud-Abusing Threat Actors
- Frequently Asked Questions (FAQs)
1. Introduction: The Mustang Panda Threat
Mustang Panda—also tracked as Bronze President, TA416, and RedDelta—is a highly active, China-based cyber-espionage threat actor that has been conducting global cyberattacks since at least 2012. The group acts in alignment with Chinese state and geopolitical intelligence objectives, primarily targeting government agencies, military entities, think tanks, and NGOs.
Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector .
The two identified campaigns target India’s hydropower sector and government entities engaged in cooperation agreements (MOUs) with Taiwanese government institutions, leveraging a newly discovered malware toolkit comprising SHARDLOADER, MINIRECON, and ZOHOMURK .
2. The Campaigns: Targeting India’s Government and Energy Sectors
2.1 Campaign Overview
2.2 The Attack Chain
Campaign I: Hydropower Sector
- Hydropower-themed lure documents delivered via spear-phishing
- Archive: Hydropower Cooperation Project Proposal.zip
- Malicious DLL hidden within archive
- Solid PDF Creator signed executable used for DLL sideloading
- SHARDLOADER v1.0 decrypts and launches MINIRECON
Campaign II: Government MOUs
- Taiwan MOU-themed lure documents
- Archive: MOU USI-INDSR TAIWAN.zip
- Malicious DLL hidden within archive
- Citrix Receiver signed executable used for DLL sideloading
- SHARDLOADER v1.1 deploys ZOHOMURK
2.3 Active Compromises
During the investigation, TRU identified active beaconing from multiple compromised systems belonging to Indian government entities, including devices associated with senior administrative personnel. The infrastructure remained operational and actively tasked by the operators throughout the observation period .
TRU collaborated with CERT-In and shared relevant indicators, threat actor infrastructure details, and technical findings to support victim notification and remediation efforts .
3. The Malware Toolkit: SHARDLOADER, MINIRECON, and ZOHOMURK
3.1 SHARDLOADER
SHARDLOADER is a DLL-based loader that demonstrates moderate sophistication, leveraging persistence and DLL sideloading to deploy MINIRECON and ZOHOMURK .
Key features:
SHARDLOADER v1.1 dropper functionality:
- Creates staging directory at C:\Users\Public\Documents
- Extracts pcl2bmp.exe (signed Citrix Receiver binary) and ctxmui.dll (ZOHOMURK implant)
- Uses RC4 decryption with hardcoded key
- Scheduled task named SolidPDFPcl2Bmp with 5-minute repetition interval
3.2 MINIRECON
MINIRECON is a newly identified implant derived from the Toneshell malware family .
Key features:
C2 infrastructure:
- Domain: couldinstallup.com (registered May 2026)
- IP: 188.208.141.177 (hosted by Leapswitch Networks, India)
- C2 running Python 3.12 with websockets 11.0.3 library
Notable discovery: 188.208.141.177 resides within the same /24 subnet as 188.208.141.196, an IP address previously identified by IBM X-Force as a Pubload C2 server associated with Mustang Panda .
3.3 ZOHOMURK
ZOHOMURK is a novel implant that leverages Zoho WorkDrive for command-and-control, data exfiltration, and remote task execution .
Key features:
OAuth credentials:
- Hardcoded refresh token, client ID, and client secret
- POST request to accounts.zoho.com/oauth/v2/token
- User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
ZOHOMURK command loop:
- List contents of victim’s inbox folder
- Download command file (readata.dat)
- Refresh OAuth token
- Trash command file from WorkDrive
- Decrypt payload with 29-byte XOR key
- Execute command based on opcode
- Upload response to outbox folder
4. Attribution: Why This Is Mustang Panda with High Confidence
Acronis TRU attributes these campaigns to Mustang Panda with high confidence based on multiple factors :
Previous Mustang Panda activity in India:
- 2021: ShadowPad campaigns targeting India’s power sector
- April 2026: LOTUSLITE variant targeting India’s banking sector
5. Why This Matters for India’s National Security
5.1 The Scale of the Threat
5.2 The Risk of Cloud Abuse
Zoho WorkDrive is commonly used across India’s government sector. Malicious traffic to it blends with normal cloud activity, making detection harder for security teams . Threat actors are increasingly abusing legitimate platforms for command-and-control operations.
5.3 Implications for Indian Organizations
- Government entities: Review cloud service usage and monitor for abnormal access patterns
- Energy sector: Geopolitically themed lures target critical infrastructure
- Organizations with Taiwan ties: Increased risk of espionage targeting
5.4 CERT-In Response
CERT-In acknowledged the research and used the findings to support its incident response and analysis activities. TRU redacted victim-identifying details before sharing findings .
6. Indicators of Compromise (IOCs) and Hunting Tips
6.1 Registry Persistence
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateBrokerTask(ZOHOMURK v2)HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ZohoUsingUpdataAnyssAll_RunOnece(ZOHOMURK v1)HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MediumNetMonIt(SHARDLOADER v1.0)
Key indicator: The misspelling “RunOnece” is unique to this actor .
6.2 Scheduled Tasks
- Task name:
SolidPDFPcl2Bmp - Trigger:
Pcl2BmpDailyTrigger - Repetition interval:
PT5M(every 5 minutes) - Action: Points to pcl2bmp.exe in
C:\Users\Public\Documents\
6.3 Mutex / Named Events
Local\MS_Edge_Update_Task_Service_Sync(ZOHOMURK v2)ZohoUsingUpdataAnyssAll_event(ZOHOMURK v1)uydgcfteionxcfd(SHARDLOADER v1.0)
6.4 File System Artifacts
C:\ProgramData\IDM\logs\(hidden, SHARDLOADER staging)C:\ProgramData\Citrix\(ZOHOMURK execution path)C:\Users\Public\Documents\pcl2bmp.exe + ctxmui.dll%LOCALAPPDATA%\Microsoft\VaultCache\(ZOHOMURK v2 persistence)%LOCALAPPDATA%\ZohoUsing\(ZOHOMURK v1 persistence)C:\ProgramData\DexpotMouseEventsPart.dat(MINIRECON 16-byte session key)readata.datin temp directories (ZOHOMURK command staging)
6.5 Network Indicators
- DNS/connections to
couldinstallup.com(MINIRECON WebSocket C2) - HTTP GET to
ipinfo.io/ipwith UAIPFetcher/1.0(ZOHOMURK v2) - HTTPS POST to
accounts.zoho.com/oauth/v2/tokenfrom non-browser processes - HTTPS traffic to
workdrive.zoho.comfrom non-browser processes
User-Agents to monitor:
6.6 Process Indicators
pcl2bmp.exeloadingctxmui.dll(Citrix sideloading)MediumInstStart.exeloadingSolidPDFCreator.dllfromC:\ProgramData\IDM\logs\- Space-padded executable names in
C:\ProgramData\Citrix\ - Any executable calling
EnumSystemLocalesAshortly afterVirtualAllocwith RWX permissions
6.7 Sideloading Pairs
Project Proposal.exe + SolidPDFCreator.dll(Campaign I)pcl2bmp.exe + ctxmui.dll(Campaign II)- All share export name
GetSPApp
7. Conclusion: Defending Against Cloud-Abusing Threat Actors
The campaigns examined in this report demonstrate Mustang Panda’s continued investment in expanding its malware arsenal and operational infrastructure while targeting sectors aligned with China’s strategic interests. The introduction of ZOHOMURK, which leverages Zoho WorkDrive for command-and-control and data exfiltration, alongside the WebSocket-enabled MINIRECON implant, reflects an effort to blend malicious activity with legitimate services commonly used across enterprise environments .
Despite these developments, the operators exposed several indicators that aided analysis and attribution, including hardcoded OAuth credentials, recurring development artefacts, plaintext identifiers, and reusable infrastructure. These findings enabled TRU to identify active compromises affecting Indian government entities and support remediation efforts in coordination with relevant authorities .
Key recommendations for defenders:
- Monitor trusted cloud services for abnormal use: Review cloud service traffic, unusual API usage, unexpected file transfers, and access patterns inconsistent with normal user behavior .
- Hunt for DLL sideloading and custom loader behavior: Look for suspicious DLL loading, unusual parent-child process relationships, compressed archive execution, and government- or energy-themed lure documents .
- Prioritize threat modeling for geopolitical and infrastructure lures: Organizations in government, energy, defense, and policy sectors should prepare for highly tailored phishing and document-based intrusion attempts tied to current strategic issues .
- Monitor Zoho WorkDrive activity: Alert on non-browser processes making API calls to Zoho WorkDrive with OAuth tokens .
- Block identified indicators: Implement blocks for C2 domain
couldinstallup.comand associated IP addresses .
Organizations in the government and energy sectors, particularly those involved in cross-border cooperation initiatives, should remain vigilant against spear-phishing campaigns using geopolitically themed lures and maintain visibility into endpoint-driven cloud service activity .
8. Frequently Asked Questions (FAQs)
Q1: What is Mustang Panda?
Mustang Panda is a China-linked cyber-espionage threat actor that has been conducting global attacks since at least 2012, targeting government agencies, military entities, think tanks, and NGOs .
Q2: What did the campaigns target?
Indian government entities and the hydropower sector, particularly organizations involved in cooperation agreements with Taiwanese institutions .
Q3: What is ZOHOMURK?
ZOHOMURK is a novel implant that abuses Zoho WorkDrive for command-and-control, data exfiltration, and remote task execution, carrying hardcoded Zoho OAuth credentials in plaintext .
Q4: How does ZOHOMURK work?
It creates folders on an operator’s Zoho WorkDrive account, reads commands from an inbox folder, executes them, and writes exfiltrated data to an outbox folder .
Q5: What is MINIRECON?
MINIRECON is a Toneshell variant that establishes WebSocket connections over HTTPS for C2, disabling certificate validation .
Q6: Were Indian government systems compromised?
Yes. Multiple compromised systems were identified, including devices associated with senior administrative personnel. Active beaconing was observed between June 12–22, 2026 .
Q7: What was CERT-In’s role?
TRU collaborated with CERT-In and shared relevant indicators and technical findings to support victim notification and remediation efforts .
Q8: How can organizations defend against these attacks?
Monitor Zoho WorkDrive usage, hunt for DLL sideloading patterns, prioritize threat modeling for geopolitical lures, and block identified indicators .
Q: If Zoho is a legitimate and secure platform, how could it be used for a cyberattack? Ans: The attackers did not “hack” Zoho’s servers. Instead, they created their own legitimate Zoho accounts, generated access tokens, and coded their malware to log into those accounts from the victim’s computer. The malware uses the secure, encrypted connection provided by Zoho to secretly transfer stolen files out of the victim’s network.
Q: Why would a Chinese APT group target India’s hydropower sector? Ans: Hydropower is a critical component of national infrastructure and a frequent point of geopolitical friction between nations sharing river systems (like the Brahmaputra). Espionage in this sector provides strategic intelligence on infrastructure development, energy capabilities, and government policy planning.
Q: If an organization uses Zoho, should they block access to it to stay safe? Ans: No. Blocking legitimate cloud platforms cripples business operations. The defense strategy relies on “behavioral monitoring”—security teams must monitor how the platform is being accessed. If a hidden, non-browser process (like a system file) suddenly starts making API calls to Zoho using strange User-Agents, it must be flagged for immediate investigation.
KNOWLEDGE CHECK QUIZ
Q: What is Mustang Panda, and what were the specific targets of their June 2026 cyber espionage campaigns? Ans: Mustang Panda is a highly active, China-linked cyber-espionage threat actor. In June 2026, they targeted Indian government entities, the critical hydropower sector, and institutions engaged in cooperation agreements (MOUs) with Taiwanese government institutions.
Q: How did the ZOHOMURK malware abuse legitimate cloud services to evade detection? Ans: ZOHOMURK was engineered to use Zoho WorkDrive (a legitimate cloud storage platform) for its Command and Control (C2) and data exfiltration. Because it uses hardcoded Zoho OAuth credentials to communicate with official Zoho servers, the malicious traffic easily blended in with normal, legitimate enterprise network activity.
Q: What technique did the attackers use to initially execute the malware without triggering basic antivirus alarms? Ans: They used a technique called “DLL Sideloading.” They sent spear-phishing emails containing legitimate, digitally signed executables (like Citrix Receiver) alongside a hidden, malicious DLL. When the victim ran the trusted executable, it automatically loaded the malicious DLL.
Q: What specific forensic artifact (a spelling mistake) strongly linked this campaign to previous Mustang Panda operations? Ans: Threat researchers found persistence registry keys containing the specific misspelling “RunOnece” (e.g., ZohoUsingUpdataAnyssAll_RunOnece). This exact typo has been previously documented in other malware variants (like Toneshell) used by Mustang Panda.
Adv. Shoeb Hakim
Cyber Security & National Security Advisor
📌 Follow me on LinkedIn for daily cyber security and national security insights: https://www.linkedin.com/in/shoebhakim
📌 Visit my website for more articles: https://www.shoebhakim.com
📌 Visit my website for legal knowledge: https://www.vakilverse.com
📌 Visit my website for research fellowship: https://www.legalcomplaince.in
♻️ Share this article with your network.
Disclaimer: This article is for informational purposes only and does not constitute legal advice.
Hashtags: #AdvShoebHakim #MustangPanda #CyberEspionage #India #ZohoWorkDrive #Malware #ZOHOMURK #MINIRECON #SHARDLOADER #NationalSecurity #CyberSecurity #CERTIn #IndiaCyberSecurity #StateSponsored #ThreatIntelligence #CriticalInfrastructure #Phishing #DLSSideloading #China #GeopoliticalEspionage #Hydropower #Taiwan #Acronis #TRU #CyberWarfare #InformationSecurity #DigitalForensics #IncidentResponse #CloudSecurity #GovernmentSecurity #EnergySector #CyberThreatIntelligence #RedDelta #BronzePresident #TA416 #LOTUSLITE #Toneshell #SpearPhishing #ZeroDay #MalwareAnalysis #CyberAttack #DataExfiltration #CommandAndControl #OAuth #WorkDrive #CitrixReceiver #SolidPDFCreator #AdvancedThreats #PersistentThreat #GeopoliticalCyberThreat #NationalCyberSecurity