- What: Reverse engineering of ToneShell beacon shellcode used by Mustang Panda
- Impact: Advanced persistent threat group using sophisticated techniques to compromise targets
2026-07-21 (Back to Inventory) [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis Author(s): m4n0w4r , Tran Trung Kien Organization: kienmanowar Blog win.toneshell Open article directly Open article on Archive.org Related Articles 2026-07-13 ⋅ kienmanowar Blog ⋅ m4n0w4r , Tran Trung Kien [QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India) 2025-11-25 ⋅ ⋅ kienmanowar Blog ⋅ m4n0w4r , Tran Trung Kien [Quick Analysis] Phishing Campaign Fake Tax Authorities to Distribute Malicious Codes VIP Keylogger 2024-09-12 ⋅ kienmanowar Blog ⋅ m4n0w4r , Tran Trung Kien [QuickNote] The Xworm malware is being spread through a phishing email XWorm