MalwarePublished 18 May 2026Updated 17 Jun 2026

Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware

Source AlienVault OTX General

Description

In April 2026, Cato CTRL identified and blocked an attempted intrusion against a global manufacturing customer involving TencShell, a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework. The activity appeared in traffic associated with a third-party user connected to the customer environment.

Impact

The attempted intrusion was blocked, so no confirmed compromise occurred. The malware implant TencShell could potentially enable command and control operations if successfully deployed. The threat actor's targeting of a global manufacturer indicates potential espionage or disruption motives. No known exploits in the wild have been reported, and no direct impact beyond the attempted intrusion is documented.

Defensive guidance

No specific patch or remediation is available or referenced for TencShell malware. Organizations should ensure intrusion detection and prevention systems are updated to detect this threat. Since the attack was blocked by Cato CTRL, continued use of such security controls is recommended. Monitor third-party user access closely and apply least privilege principles.

Indicators of compromise

Domains 1

gin-tne-fahcesmukw.cn-hangzhou.fcapp.run

IP addresses 1

CC=HK ASN=AS64050 bgpnet global asn

45.64.52.242

Hashes 71

cdb9d76093d0938f30d93bcce4f58b13b4b21c9188eea387c6d9ec6f4cb4aad4
12986838bf5c0b638edca3ac84c9e18fMD5 of 01dc3e7e673b4f2682f29b19ecabf9a6ec9c3042c9b1cfb39dbdddf1dda680ab
1da53ba0766c902a50ba40271b82e557MD5 of 12c6d0e603386b81751d95b32d1698d794c99343abb06d066b0f6060e8690aca
20150ed3ac726c486d60b2be05ee2b74MD5 of 5d19c07e3fb7ac4ff56a23f6e658d691f381442b1db2f8c5f345563c1cdc8998
2c3e4e7219e33327915a4371051fe84fMD5 of cdb9d76093d0938f30d93bcce4f58b13b4b21c9188eea387c6d9ec6f4cb4aad4
35f56e4a65b73a29e446b13eaff7eedeMD5 of 3ffe3a6f328a6459624bd93edd206e2256b2753e17137cbc1530b91fa325ecac
4dbb6a1ae553dc9659cd734fc5586f8cMD5 of 065f5a605ac04d5f443089b65aa1393414ee38c4ee8f780e7d78c06b46504ae4
7aa333c814c9ac618ae2fab66a6eddefMD5 of 2a010bd1061e11da6f5cf951a3ebd23503916e159e3d486cc722b4b8b4a099c9
d8d4e5be6f2014d17001f3a5ac7c1dcfMD5 of ed6058f0b0735ba56b781dea39353625fcb56bc3e77bf2d26a648511d754d216
debb2b7123e2b024ac6ae77c1aa59da2MD5 of 5eff99959683480d2280c931e433af836adf6a8b7a8489b1af17cddcf480cf63

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 May 2026, 19:51 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 1

Hashes 71

Community reviews

Related threats