Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

Mustang Panda, a China-aligned espionage group, is conducting two campaigns targeting the Indian government and hydropower entities. The group is utilizing new malware and leveraging a legitimate cloud service as a command channel. Researchers at Acronis Threat Research Unit have discovered active compromises within Indian government networks, including systems used by senior administrative staff. The unit collaborated with unspecified entities to uncover these compromises. Mustang Panda's use of a cloud service as a command channel involves Zoho WorkDrive. The attacks indicate the group's ongoing efforts to target Indian government and related entities.