# Mustang Panda Weaponizes Zoho WorkDrive Against Indian Government in Sophisticated Supply Chain Attack
China-aligned espionage group deploys three new malware tools to target government and energy infrastructure, disguising command traffic as legitimate cloud activity.
## The Threat
The Chinese-aligned espionage group Mustang Panda has launched a sophisticated campaign against Indian government networks and the country's hydropower sector, deploying previously unknown malware and abusing Zoho WorkDrive—a legitimate cloud storage platform widely used across India's public sector—as a covert command and control infrastructure.
Security researchers at Acronis Threat Research Unit detected active compromises inside Indian government networks, including systems used by senior administrative staff. The campaign was reported to India's CERT-In (Indian Computer Emergency Response Team) for notification and remediation. The attack represents a significant escalation in the group's targeting of India, combining advanced evasion techniques with intelligence collection objectives focused on the country's hydropower infrastructure and its deepening defense relationship with Taiwan.
The key innovation in this attack chain: using an attacker-controlled Zoho WorkDrive account as a dead drop for commands and stolen data. By leveraging a legitimate, trusted cloud service, Mustang Panda effectively hid its malicious traffic within the background noise of normal corporate cloud activity—a technique that blinds traditional network monitoring tools and makes detection extraordinarily difficult.
## Attack Infrastructure and Delivery
Acronis identified two distinct operational campaigns, both arriving through the same vector: spear-phishing emails containing ZIP archives with hidden malicious DLL files. The targeted recipients received carefully crafted lures designed to exploit their professional interests:
This precision targeting indicates extensive reconnaissance and suggests the attackers possessed detailed knowledge of the victims' roles and current organizational initiatives.
The malicious archives contained DLL files hidden using file system flags—a basic but effective obfuscation technique that prevents casual inspection of ZIP contents.
## The Malware Arsenal: Three New Tools
Acronis researchers identified three previously unknown malware tools deployed in these campaigns:
### SHARDLOADER: The Execution Gateway
SHARDLOADER is a loader component that enables the initial malware deployment through DLL sideloading—a technique where attackers place a malicious DLL alongside a legitimate signed binary, causing the legitimate application to load the attacker's code during startup.
The campaign used two different legitimate targets for sideloading:
| Campaign | Legitimate Binary | Purpose |
|----------|-------------------|---------|
| Hydropower targeting | Solid PDF Creator | Process creation and trusted execution path |
| Defense/Taiwan targeting | Citrix Receiver | Widespread enterprise tool enabling stealthy execution |
By leveraging legitimate, digitally signed binaries, SHARDLOADER achieves two critical objectives: evading application whitelisting controls and gaining the trust signature of established software vendors.
### MINIRECON: The Persistent Backdoor
MINIRECON is a significantly reworked variant of the Toneshell backdoor previously documented by IBM X-Force researchers. Unlike the original Toneshell, MINIRECON modernized its command and control mechanism to use WebSocket connections over HTTPS—a sophisticated upgrade that blends malicious traffic with legitimate encrypted web traffic.
The WebSocket implementation is particularly important: it establishes a persistent, bidirectional communication channel that can transmit commands and exfiltrate data with minimal detectability. WebSocket traffic resembles ordinary browser activity, further obscuring the malware's presence.
### ZOHOMURK: The Cloud-Based Dead Drop
ZOHOMURK represents the novel centerpiece of this attack. This malware component carries hardcoded Zoho OAuth credentials and leverages those credentials to establish persistent access to an attacker-controlled Zoho WorkDrive account.
The malware operates using an elegant dead drop mechanism:
This cloud-based infrastructure provides Mustang Panda with several operational advantages:
## Attribution: Tracking Mustang Panda
Acronis attributed the campaign to Mustang Panda with high confidence based on multiple converging indicators:
1. Code overlap: MINIRECON shares significant code similarities with the previously documented Toneshell backdoor attributed to Mustang Panda
2. Infrastructure reuse: Command servers operated in the same network block as infrastructure IBM X-Force previously tied to Mustang Panda operations
3. Operational security failures: The group reused a distinctive typo—"RunOnece"—across multiple implants, a pattern consistent with previous Mustang Panda campaigns
4. Sideloading chain: The specific DLL sideloading technique and target binaries match previous group operations
The operational security was notably thin: hardcoded OAuth tokens, plaintext identifiers, and infrastructure reuse all contributed to successful attribution. Active beaconing from compromised systems ran from June 12 to June 22, 2026, providing a clear timeline for incident response efforts.
## Geopolitical Context and Implications
This campaign reflects broader Chinese espionage priorities targeting India's critical infrastructure:
This represents part of a multi-year pattern. The 2021 RedEcho campaign, also attributed to Chinese threat actors, specifically targeted India's electricity grid with the ShadowPad malware. The consistent focus on India's energy infrastructure suggests sustained intelligence collection requirements at the highest levels of China's security apparatus.
## HackWire Analysis
The weaponization of Zoho WorkDrive exposes a critical blind spot in enterprise security: the implicit trust placed in legitimate cloud services. Most organizations allow WorkDrive traffic freely, monitor it minimally, and assume that "legitimate vendor" equals "legitimate use." Mustang Panda has effectively weaponized that assumption.
This attack is particularly sophisticated not because of the malware itself—DLL sideloading and backdoors are well-understood techniques—but because it exploits the gap between detection capabilities and trust assumptions. A standard Zoho WorkDrive API call from a government network will never trigger an alert. A malicious implant disguised as such a call is essentially invisible.
The real risk extends beyond Indian government networks. Any organization using Zoho WorkDrive, OneDrive, Google Drive, or similar services should immediately audit cloud API usage: which endpoints are legitimately calling cloud APIs? Which processes have no business reason to be doing so? Most organizations will discover processes and user accounts behaving suspiciously—not necessarily compromised, but certainly not behaving as intended.
The timeline is also telling: active beaconing June 12-22 suggests either incident detection and shutdown, or operator-directed data exfiltration completion. If India's CERT-In discovered the breach quickly, this represents a minor victory for Indian incident response. If the attackers simply concluded their operation, it means the intelligence collection objective has already been met. Either way, the compromise was successful, and the data has been accessed.
For critical infrastructure operators, this should trigger three immediate actions: (1) hunting for similar sideloading chains and scheduled task persistence on Windows systems, (2) logging and monitoring all cloud API usage with focus on non-browser processes, and (3) reviewing multi-factor authentication enforcement on cloud accounts, particularly those with administrative privileges.
— *HackWire Editorial*
## Indicators and Recommendations
Organizations, particularly those in government, energy, and cross-border operations, should implement the following detection and prevention measures:
Technical Indicators:
Defensive Priorities:
Hunting Guidance:
Search for processes making unexpected calls to Zoho APIs or similar cloud services. Many organizations will identify configuration agents, backup tools, or development utilities—but anomalies should trigger immediate investigation.
---
## Related Coverage