India's government and energy sectors targeted with ZOHOMURK and MINIRECON

Mustang Panda orchestrated two concurrent espionage campaigns targeting Indian government entities and hydropower infrastructure between May and June 2026. The campaigns leveraged DLL sideloading via legitimate executables to deploy newly identified malware including SHARDLOADER, MINIRECON, and ZOHOMURK. MINIRECON represents an evolution of Toneshell with WebSocket-based command-and-control capabilities, while ZOHOMURK abuses Zoho WorkDrive cloud services for C2 communications and data exfiltration. Distribution occurred through spear-phishing with lures themed around India-Taiwan cooperation agreements and hydropower projects. The activity demonstrates code overlaps with previous tooling, infrastructure proximity to known operations, and targeting patterns aligned with Chinese strategic intelligence collection priorities. Multiple compromised government systems were identified, with coordination conducted through CERT-In for victim notification and remediation.

• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• How AI Revived a Stalled Attack on a U.S. RetailerMalware2026-11-12
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• Off the Rails: Inside an Exposed Silent Lynx ServerMalware2026-11-11
• ValleyRAT is spreading disguised as adwareMalware2026-08-31