[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faKV_TtyTQSwaYm60FzupmPeoGSgDDL2wuQjupdwetoc":3},{"article":4,"iocs":55,"watch_terms":91,"solutions":92,"lesson":182},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2beb0eb7-18dd-4460-b749-308b005ede95","Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks","mustang-panda-uses-zoho-workdrive-as-command-channel-in-indian-government-attack-5b93a9","The China-aligned espionage group Mustang Panda is running two campaigns against the Indian government and hydropower targets, deploying new malware and turning a legitimate cloud service into its command channel. Acronis Threat Research Unit found active compromises inside Indian government networks, including machines used by senior administrative staff, and worked with","The China-aligned threat actor Mustang Panda is conducting two espionage campaigns against Indian government and hydropower entities. The group is employing new malware, including SHARDLOADER, MINIRECON, and ZOHOMURK, which leverages Zoho WorkDrive as a command and control channel to exfiltrate data and receive instructions, making the malicious activity blend in with legitimate cloud traffic. Acronis Threat Research Unit identified these compromises and is working with CERT-In for remediation.","Mustang Panda targets Indian government with new malware using Zoho WorkDrive for C2.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmustang-panda-uses-zoho-workdrive-as.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj4479X60pqma2HNkNzrVQuQlGImd-48w4eYTTW-wylTLfK7XfLPtmNOMi79oy48LNiFg-4a_vqF378ZobR2Dy6VTO38VxbsFc_l8xQypwe-V43txSB7f73JS142E4uBXjrLKx0lcS-UOUMZ45kLeYgaqCjg2Je2TElLosoBvARIQpzam5q3ckk5CVXsoAF\u002Fs1600\u002Findia-china.jpg","2026-06-29T15:03:40+00:00","2026-06-29T18:00:20.517942+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Mustang Panda","threat_actor",{"name":21,"type":22},"Zoho","vendor",{"name":24,"type":25},"Zoho WorkDrive","product",{"name":27,"type":22},"Acronis",{"name":29,"type":25},"Solid PDF Creator",{"name":31,"type":25},"Citrix Receiver","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,73,76,79,82,85,88],{"type":57,"value":58,"context":59},"domain","couldinstallup[.]com","Command and Control domain",{"type":49,"value":61,"context":62},"SHARDLOADER","Loader malware",{"type":49,"value":64,"context":65},"MINIRECON","Reworked Toneshell backdoor variant",{"type":49,"value":67,"context":68},"ZOHOMURK","Novel implant using Zoho WorkDrive for C2",{"type":70,"value":71,"context":72},"mitre_attack","T1059.001","PowerShell (implied by loader\u002Fimplant activity)",{"type":70,"value":74,"context":75},"T1105","Ingress Tool Transfer (via cloud service)",{"type":70,"value":77,"context":78},"T1071.001","Web Protocols (HTTPS\u002FWebSocket for C2)",{"type":70,"value":80,"context":81},"T1573.002","Encrypted Channel (HTTPS)",{"type":70,"value":83,"context":84},"T1027","Obfuscated Files or Information (hidden DLL)",{"type":70,"value":86,"context":87},"T1204.002","Malicious Link\u002FObject (spear-phishing attachment)",{"type":70,"value":89,"context":90},"T1055.012","Process Injection (DLL sideloading)",[21,27,24],{"controls":93,"vendors":181},[94,123,152],{"slug":95,"name":96,"problem":97,"products":98},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":153,"name":154,"problem":155,"products":156},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[157,165,173],{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":166,"vendor_name":167,"vendor_logo":168,"product_slug":169,"product_name":170,"url":171,"description":172},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":174,"vendor_name":175,"vendor_logo":176,"product_slug":177,"product_name":178,"url":179,"description":180},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":183,"title":184,"body":185,"framework_refs":186,"framework_notes":198},"mustang-panda-hides-c2-traffic-inside-zoho-workdrive-to-target-indian-government","Mustang Panda Hides C2 Traffic Inside Zoho WorkDrive to Target Indian Government","The China-aligned threat actor Mustang Panda demonstrates a sophisticated evasion technique by tunneling command-and-control communications through Zoho WorkDrive, a legitimate cloud service trusted by many enterprises. This 'living-off-the-land cloud' approach makes malicious traffic virtually indistinguishable from normal business activity, bypassing traditional perimeter defenses that rely on domain or IP reputation. The deployment of novel malware families — SHARDLOADER, MINIRECON, and ZOHOMURK — indicates deliberate investment in tools designed to evade signature-based detection. This campaign underscores the growing risk of threat actors weaponizing trusted SaaS platforms, rendering conventional network-based controls ineffective without deeper behavioral analysis and strict egress controls.",[187,188,189,190,191,192,193,194,195,196,197],"NIST SP 800-53 SI-4 (Information System Monitoring)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 CA-7 (Continuous Monitoring)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 12 (Network Infrastructure Management)","CIS Control 4 (Secure Configuration of Enterprise Assets)","MITRE ATT&CK T1102 (Web Service - C2 via Cloud Services)","MITRE ATT&CK T1041 (Exfiltration Over C2 Channel)","ISO\u002FIEC 27001 A.13.1 (Network Security Management)","CERT-In Guidelines for Critical Information Infrastructure Protection",{}]