MITRE ATT&CKsoftware (malware)

S1239 TONESHELL

Published 2025-09-15 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2025-09-15

Description

TONESHELL is a custom backdoor that has been used since at least Q1 2021. TONESHELL malware has previously been leveraged by Chinese affiliated actors identified as Mustang Panda.

Related

Uses · MITRE ATT&CK (43)

  • T1680 Local Storage Discovery technique
  • T1678 Delay Execution technique
  • T1480.002 Mutual Exclusion sub-technique
  • T1027.012 LNK Icon Smuggling sub-technique
  • T1027.007 Dynamic API Resolution sub-technique
  • T1622 Debugger Evasion technique
  • T1218.013 Mavinject sub-technique
  • T1480.001 Environmental Keying sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.002 Non-Standard Encoding sub-technique
  • T1574.001 DLL sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.002 User Activity Based Checks sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1559 Inter-Process Communication technique
  • T1056.001 Keylogging sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.001 Binary Padding sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1053.005 Scheduled Task sub-technique
Show all 43 ›

Referenced by MITRE ATT&CK · uses (1)

  • G0129 Mustang Panda group

References