H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HIUPAN](https://attack.mitre.org/software/S1230) (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2024. (Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)

Labels

malware

10 recorded

Relationships

uses

to Delay Execution

Technique

uses

to DLL

Technique

uses

to Hidden Files and Directories

Technique

uses

to Malicious File

Technique

uses

to Modify Registry

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Replication Through Removable Media

Technique

uses

from Mustang Panda

Group

3 external

References

mitre-attack

S1230

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html