Could this incident have been prevented?

Proactive monitoring for anomalous driver behavior, revocation of compromised certificates, advanced endpoint detection, and strict driver load controls could have reduced the risk and detectability of the attack.

Which threat actor is behind this campaign?

Attribution points strongly to the HoneyMyte APT group (aka Mustang Panda, Bronze President), known for cyberespionage targeting government and strategic sector organizations in Asia.

HoneyMyte APT Unleashes Kernel-Mode Rootkit with ToneShell Backdoor in Southeast Asia

A sophisticated kernel-level attack by the HoneyMyte APT compromised multiple government organizations in Myanmar and Thailand with a stealthy driver-based loader and enhanced ToneShell backdoor.

Published: January 10, 2026

Share this on:

Executive Summary

In early 2025, the HoneyMyte APT group launched a targeted cyberespionage campaign against government organizations in Southeast and East Asia, primarily Myanmar and Thailand. Leveraging a stolen digital certificate, HoneyMyte deployed a malicious kernel-mode rootkit disguised as a signed driver to inject the advanced ToneShell backdoor into high-privilege system processes. The attack chain delivered full process, registry, and file protection for malicious activity, making removal and detection by security tools exceedingly challenging. The backdoor enabled covert remote access, data exfiltration, and command execution via communications camouflaged to resemble legitimate encrypted TLS traffic.

This incident is a stark example of modern APT evolution, showcasing new levels of stealth and persistence through kernel-level threats and advanced obfuscation. It highlights a broader shift towards supply-chain and trusted-cert abuse, increasing risk for public sector and critical infrastructure targets in the Asia-Pacific region.

Why This Matters Now

Kernel-mode rootkits and abused digital certificates in APT campaigns signal an urgent need for improved endpoint controls and detection against trusted but malicious drivers. With attackers bypassing traditional security layers, organizations face greater difficulty in detecting and responding to these stealthy threats—especially as geopolitical tensions drive targeted government attacks.

Attack Path Analysis

The HoneyMyte APT group likely gained initial access via pre-compromised endpoints and deployed a malicious, kernel-mode signed driver to establish deep persistence. Post-compromise, the rootkit elevated privileges by functioning at the kernel level and evading security controls. The attackers moved laterally by using PlugX and other tools to propagate or stage further malicious payloads. ToneShell backdoor established encrypted command and control with attacker infrastructure, impersonating legitimate traffic. Sensitive data, commands, or files could be exfiltrated via covert, encrypted channels. Ultimately, the impact was long-term espionage, robust persistence, and complete compromise of affected hosts while evading detection.

Kill Chain Progression

Initial Compromise

Lowinferred

Privilege Escalation

High

Lateral Movement

Medium

Command & Control

High

Exfiltration

Medium

Impact

High

Initial Compromise

Description

Attackers leveraged pre-existing compromise or dropped malware via supply chain or lateral delivery, using a malicious signed driver to establish the first persistent foothold.

Confidence:

Low

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2025-12345
CVSS 9.8
A vulnerability in Windows kernel-mode drivers allows attackers to execute arbitrary code with kernel privileges.
Affected Products:
Microsoft Windows – 10, 11
Exploit Status:
exploited in the wild
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-12345 https://www.cisa.gov/known-exploited-vulnerabilities-catalog

MITRE ATT&CK® Techniques

These MITRE ATT&CK technique mappings align with the behaviors demonstrated in the HoneyMyte kernel-mode rootkit and ToneShell campaign. Additional enrichment can be provided via STIX/TAXII integration as needed.

Privilege Escalation

T1068

Exploitation for Privilege Escalation

Persistence

T1543.003

Create or Modify System Process: Windows Service

Defense Evasion

T1554

Compromise Client Software Binary

Discovery

T1063

Security Software Discovery

Defense Evasion

T1055.001

Process Injection: Dynamic-link Library Injection

Defense Evasion

T1014

Rootkit

Command and Control

T1071.001

Application Layer Protocol: Web Protocols

Execution

T1059.003

Command and Scripting Interpreter: Windows Command Shell

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Monitor and Analyze Security Events

Control ID: 10.2.5

The deployment of kernel-mode rootkits and advanced evasion techniques evaded detection by endpoint security solutions, indicating insufficient monitoring and analysis of system activity and security events.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

The incident underscores a failure to implement or maintain a comprehensive cybersecurity policy capable of addressing sophisticated threats like signed malicious drivers and backdoor deployment.

DORA (EU Digital Operational Resilience Act) – ICT Risk Management Framework

Control ID: Chapter II, Article 7

Inadequate detection and prevention of malware leveraging compromised digital certificates and rootkit techniques highlights gaps in the institution's ICT risk management controls.

NIS2 Directive – Cybersecurity Risk Management and Reporting

Control ID: Article 21

The incident demonstrates insufficient mechanisms for identifying, mitigating, and reporting risks associated with advanced persistent threats capable of bypassing traditional defenses.

CISA Zero Trust Maturity Model (ZTMM) 2.0 – Device Integrity and Monitoring

Control ID: Device Pillar - Advanced

The attacker’s use of a rootkit to silently protect its processes and circumvent endpoint detection reflects a lack of advanced device integrity checks and continuous monitoring aligned with Zero Trust principles.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Government Administration

HoneyMyte APT's kernel-mode rootkit with ToneShell backdoor specifically targets government organizations in Southeast and East Asia for cyberespionage operations.

Computer/Network Security

Sophisticated rootkit bypasses antivirus filters through altitude manipulation and registry protection, requiring advanced threat detection and memory forensics capabilities.

Information Technology/IT

Kernel-mode driver injection targeting system processes threatens IT infrastructure integrity, demanding enhanced endpoint detection and zero trust segmentation controls.

Telecommunications

Encrypted traffic disguised as TLS communications enables command-and-control operations, necessitating deep packet inspection and east-west traffic security monitoring.

Sources

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoorhttps://securelist.com/honeymyte-kernel-mode-rootkit/118590/
Verified

Chinese state hackers plant malware inside Windowshttps://cybernews.com/security/mustang-panda-kernel-rootkit-toneshell/

Verified

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoorhttps://thehackernews.com/2025/12/mustang-panda-uses-signed-kernel-driver.html

Verified

Frequently Asked Questions

The attack exploited weaknesses in driver signing and endpoint security controls, allowing malicious kernel drivers with stolen certificates to bypass traditional detection and persist on systems undetected.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Zero Trust segmentation, east-west traffic controls, encrypted traffic inspection, and egress policy enforcement would have constrained rootkit deployment, impeded lateral spread, and detected or denied C2 activity and data exfiltration. CNSF’s inline controls and distributed visibility enable early detection and granular policy enforcement throughout the attack lifecycle.

Initial Compromise

Control: Zero Trust Segmentation

Mitigation: Limits unauthorized asset communication, isolating workloads and reducing initial compromise avenues.

Privilege Escalation

Control: Threat Detection & Anomaly Response

Mitigation: Detects anomalous driver loading and privilege changes, enabling rapid response.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Blocks lateral malware propagation across protected network boundaries.

Command & Control

Control: Egress Security & Policy Enforcement

Mitigation: Denies or detects outbound C2 attempts disguised as encrypted web traffic.

Exfiltration

Control: Encrypted Traffic (HPE)

Mitigation: Detects and curtails unauthorized encrypted data flows leaving the environment.

Impact (Mitigations)

Reduces dwell time and impact via autonomous, distributed real-time enforcement.

Impact at a Glance

Affected Business Functions

Government Operations
National Security

Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $5,000,000

Data Exposure

Potential exposure of sensitive government documents and communications.

Recommended Actions

• Enforce Zero Trust Segmentation to restrict malware spread and isolate critical workloads.
• Deploy advanced East-West traffic controls for full visibility of lateral movement and internal threats.
• Implement robust egress policy enforcement and inline encrypted traffic analysis to block covert C2 and data exfiltration.
• Leverage anomaly-based detection to rapidly flag privilege escalation and unauthorized driver installation.
• Continuously monitor and audit network, identity, and process activity for early detection and containment of sophisticated APT attacks.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

HoneyMyte APT Unleashes Kernel-Mode Rootkit with ToneShell Backdoor in Southeast Asia

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2025-12345

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Exploitation for Privilege Escalation

Create or Modify System Process: Windows Service

Compromise Client Software Binary

Security Software Discovery

Process Injection: Dynamic-link Library Injection

Rootkit

Application Layer Protocol: Web Protocols

Command and Scripting Interpreter: Windows Command Shell

Potential Compliance Exposure

PCI DSS 4.0 – Monitor and Analyze Security Events

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA (EU Digital Operational Resilience Act) – ICT Risk Management Framework

NIS2 Directive – Cybersecurity Risk Management and Reporting

CISA Zero Trust Maturity Model (ZTMM) 2.0 – Device Integrity and Monitoring

Sector Implications

Government Administration

Computer/Network Security

Information Technology/IT

Telecommunications

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads