CampaignPublished 11 Sep 2025Updated 11 Oct 2025

Updated Toneshell backdoor and novel SnakeDisk USB worm dropped

Source AlienVault OTX General

Description

In mid-2025, China-aligned threat actor Hive0154 deployed new malware variants, including an updated Toneshell backdoor and a novel USB worm called SnakeDisk. Toneshell9 evades detection and supports C2 communication through local proxies. SnakeDisk only executes on devices in Thailand, propagating via USB drives and dropping the Yokai backdoor. The malware shows code overlaps with previous Tonedisk variants. Hive0154 continues to refine its large malware arsenal, targeting organizations worldwide with frequent development cycles. The group uses multiple custom loaders, backdoors, and USB worm families, showcasing advanced capabilities. Defenders should monitor for suspicious network activity, USB drives with hidden components, and implement recommended security measures to mitigate risks from this evolving threat.

Impact

For European organizations, the threat poses a medium risk primarily due to the espionage focus and the use of USB worms and backdoors that can facilitate unauthorized access and data exfiltration. Although SnakeDisk currently executes only on devices in Thailand, the updated Toneshell backdoor has global targeting potential, which could impact European entities, especially those with supply chain or business ties to Southeast Asia or China. The use of local proxies for C2 communications complicates detection and may allow attackers to maintain persistence undetected for extended periods. The USB worm vector, while geographically limited for SnakeDisk, underscores the risk of removable media as an infection vector, which remains relevant for European organizations with international operations or employees traveling to affected regions. The espionage nature of Hive0154 suggests targeting of sensitive intellectual property, government, defense, or critical infrastructure sectors. The medium severity reflects the complexity of the malware and its stealth capabilities, balanced against the current limited geographic execution of the USB worm. However, the evolving nature of Hive0154’s arsenal means European organizations should remain vigilant against potential future expansions of this threat.

Defensive guidance

European organizations should implement a layered defense strategy tailored to the specific tactics used by Hive0154. Key measures include: 1) Enforce strict USB device control policies, including disabling autorun features and restricting use of unauthorized removable media. 2) Deploy endpoint detection and response (EDR) solutions capable of detecting anomalous behaviors associated with backdoors and worms, such as unusual proxy usage or hidden file system activity. 3) Monitor network traffic for proxy-based C2 communications, including the use of local proxies and uncommon ports, and implement network segmentation to limit lateral movement. 4) Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided file hashes and IP addresses. 5) Educate employees on the risks of USB devices and implement physical security controls to prevent unauthorized device usage. 6) Maintain up-to-date threat intelligence feeds and integrate them into security monitoring tools to detect emerging Hive0154 activity. 7) Apply strict access controls and multi-factor authentication to limit attacker persistence and privilege escalation. 8) Regularly audit and harden systems against known persistence techniques used by Hive0154, including custom loaders and backdoors. These targeted actions go beyond generic advice by focusing on the specific attack vectors and malware behaviors observed in this campaign.

Indicators of compromise

Domains 1

www.slickvpn.com

IP addresses 4

118.174.183.89
123.253.34.44
146.70.29.229
188.208.141.196

Hashes 4

434fe22d538e74a1e40e58255f844cd2
3158a8186a0322d245f0c36e81fd0c432a223159
318a1ebc0692d1d012d20d306d6634b196cc387b1f4bc38f97dd437f117c7e20
bb5bb82e5caf7d4dbbe878b75b23f793a5f3c5ca6dba70d8be447e8c004d26ce

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Sep 2025, 20:18 UTC

MITRE ATT&CK techniques23 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 4

Hashes 4

Community reviews

Related threats