Mustang Panda Hides C2 Traffic Inside Zoho WorkDrive to Target Indian Government
Written by AI from the linked story. Not reviewed by an editor. How this works
The China-aligned threat actor Mustang Panda demonstrates a sophisticated evasion technique by tunneling command-and-control communications through Zoho WorkDrive, a legitimate cloud service trusted by many enterprises. This 'living-off-the-land cloud' approach makes malicious traffic virtually indistinguishable from normal business activity, bypassing traditional perimeter defenses that rely on domain or IP reputation. The deployment of novel malware families — SHARDLOADER, MINIRECON, and ZOHOMURK — indicates deliberate investment in tools designed to evade signature-based detection. This campaign underscores the growing risk of threat actors weaponizing trusted SaaS platforms, rendering conventional network-based controls ineffective without deeper behavioral analysis and strict egress controls.
Tactical Insight
Immediate actions
- Audit and restrict outbound connections to cloud storage services (e.g., Zoho WorkDrive, OneDrive, Google Drive) to only approved business use cases via application-aware firewall rules.
- Deploy endpoint detection and response (EDR) tools capable of behavioral analysis to identify novel malware like SHARDLOADER and MINIRECON regardless of signature availability.
- Immediately apply CERT-In advisories and threat intelligence indicators related to this Mustang Panda campaign across all government and critical infrastructure endpoints.
Detection measures
- Implement deep packet inspection and SSL/TLS decryption on egress traffic to inspect data transfers to cloud platforms for anomalous volume or frequency patterns.
- Configure a SIEM to alert on unusual process-to-cloud-service communication patterns, particularly from government endpoints accessing Zoho WorkDrive outside of business hours or at high data volumes.
- Establish a baseline of normal cloud service usage across the network and trigger alerts on statistical deviations that may indicate C2 beaconing behavior.
Long-term improvements
- Enforce Zero Trust network architecture principles, requiring explicit authorization for every endpoint-to-cloud-service communication channel.
- Implement network segmentation to isolate critical government and hydropower infrastructure systems from general internet access, limiting lateral movement and data exfiltration paths.
- Establish a formal threat intelligence program that continuously ingests nation-state actor TTPs (particularly APT groups targeting critical infrastructure) and updates detection rules accordingly.