Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

The China-aligned threat actor Mustang Panda demonstrates a sophisticated evasion technique by tunneling command-and-control communications through Zoho WorkDrive, a legitimate cloud service trusted by many enterprises. This 'living-off-the-land cloud' approach makes malicious traffic virtually indistinguishable from normal business activity, bypassing traditional perimeter defenses that rely on domain or IP reputation. The deployment of novel malware families — SHARDLOADER, MINIRECON, and ZOHOMURK — indicates deliberate investment in tools designed to evade signature-based detection. This campaign underscores the growing risk of threat actors weaponizing trusted SaaS platforms, rendering conventional network-based controls ineffective without deeper behavioral analysis and strict egress controls.