Malware & Threats Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor. Ionut ArghireDecember 30, 2025