H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

TONESHELL

[TONESHELL](https://attack.mitre.org/software/S1239) is a custom backdoor that has been used since at least Q1 2021.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023) [TONESHELL](https://attack.mitre.org/software/S1239) malware has previously been leveraged by Chinese affiliated actors identified as [Mustang Panda](https://attack.mitre.org/groups/G0129).(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Zscaler)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[TONESHELL](https://attack.mitre.org/software/S1239) is a custom backdoor that has been used since at least Q1 2021.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023) [TONESHELL](https://attack.mitre.org/software/S1239) malware has previously been leveraged by Chinese affiliated actors identified as [Mustang Panda](https://attack.mitre.org/groups/G0129).(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Zscaler)

Labels

malware
44 recorded

Relationships

uses
from Mustang Panda
Group
uses
to Account Discovery
Technique
uses
to Application Window Discovery
Technique
uses
to Archive via Utility
Technique
uses
to Binary Padding
Technique
uses
to Code Signing
Technique
uses
to Create Process with Token
Technique
uses
to Debugger Evasion
Technique
uses
to Delay Execution
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Dynamic API Resolution
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Environmental Keying
Technique
uses
to Execution Guardrails
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Inter-Process Communication
Technique
uses
to Keylogging
Technique
uses
to LNK Icon Smuggling
Technique
uses
to Local Storage Discovery
Technique
uses
to Masquerade Task or Service
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Mavinject
Technique
uses
to Mutual Exclusion
Technique
uses
to Native API
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Non-Standard Encoding
Technique
uses
to Process Discovery
Technique
uses
to Protocol or Service Impersonation
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Regsvr32
Technique
uses
to Scheduled Task
Technique
uses
to Screen Capture
Technique
uses
to Security Software Discovery
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Traffic Signaling
Technique
uses
to User Activity Based Checks
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
uses
to Windows Service
Technique
4 external

References

mitre-attack
S1239
open
ATTACKIQ MUSTANG PANDA TONESHELL March 2023
https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/
open
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023
https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/
open
Zscaler
https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance