Hive0154 Evolves with SnakeDisk and EnhancedToneshell Backdoor

Hive0154 Evolves with SnakeDisk and Enhanced Toneshell Backdoor

Summary

In mid-2025, the China-aligned threat actor Hive0154 (also known as Mustang Panda, Bronze President, TEMP.Hex, HoneyMyte, Red Lich, Earth Preta, Camaro Dragon, PKPLUG, Stately Taurus, Twill Typhoon, G0129) launched a new wave of cyber-espionage campaigns targeting government and defense organizations across East Asia.

The campaign introduces SnakeDisk, a USB-propagating worm designed to infiltrate air-gapped environments, and heavily obfuscated variants of Toneshell (including Toneshell9), which use proxy abuse, TLS-mimicking beaconing, and dual reverse shells to blend into normal network traffic. The operation also delivers weaponized archives disguised as official government documents through cloud storage services, adding a strong social engineering component.

Attack Details

• Geographic & Industry Targeting: Samples were traced to Singapore and Thailand, with a focus on government and military networks.

• SnakeDisk: Spreads via USB drives, verifies execution on Thai systems, hides user files, and drops malicious executables under disguised filenames. Uses DLL sideloading for stealthy execution and ultimately deploys the Yokai backdoor for remote command execution and covert persistence.

• Toneshell Evolution:

  • Toneshell8 (March 2025): Introduced junk code, custom Linear Congruential Generator (LCG) for obfuscation, and concealed C2 response codes.

  • Toneshell9 (July 2025): A major leap forward with stealth DLL sideloading, proxy enumeration, and TLS-beaconing to evade network detection. Capable of running two reverse shells simultaneously and blending into enterprise traffic.

• Pubload & Yokai: Used as loaders and secondary backdoors, extending attacker dwell time.

• Weaponized Archives: Example campaign included CallNotes.zip, disguised as Myanmar government communication, hosted on Box Cloud Storage, containing loaders for Pubload and multiple Toneshell variants.

Recommendations

• Harden USB and Removable Media Policies: Disable autorun, allow only trusted, pre-scanned devices, and monitor for unauthorized USB activity.

• Network Traffic Monitoring: Inspect TLS traffic for anomalies, monitor proxy lookups from endpoints, and detect unusual beaconing intervals.

• Strengthen Email & Cloud Security: Enable MFA, implement advanced email security gateways, and educate users on spear-phishing and archive-based payload risks.

• Deploy Advanced EDR/NGAV: Use behavioral and ML-based detections to catch sideloaded DLLs, hidden reverse shells, and worm-like USB propagation.

Indicators of Compromise (IoCs)

SHA256 Hashes

• f8b28cae687bd55a148d363d58f13a797486f12221f0e0d080ffb53611d54231

• 8132beeb25ce7baed0b561922d264b2a9852957df7b6a3daacfbb3a969485c79

• d1466dca25e28f0b7fae71d5c2abc07b397037a9e674f38602690e96cc5b2bd4

• 1272a0853651069ed4dc505007e8525f99e1454f9e033bcc2e58d60fdafa4f02

• b8c31b8d8af9e6eae15f30019e39c52b1a53aa1c8b0c93c8d075254ed10d8dfc

• 7087e84f69c47910fd39c3869a706e55324783af8d03465a9e7bfde52fe4d1d6

• 38fcd10100f1bfd75f8dc0883b0c2cb48321ef1c57906798a422f2a2de17d50c

• 69cb87b2d8ee50f46dae791b5a0c5735a7554cc3c21bb1d989baa0f38c45085c

• 564a03763879aaed4da8a8c1d6067f4112d8e13bb46c2f80e0fcb9ffdd40384c

• e4bb60d899699fd84126f9fa0dff72314610c56fffca3d11f3b6fc93fcb75e00

• c2d1ff85e9bb8feb14fd015dceee166c2e52e2226c07e23acc348815c0eb4608

• bdbc936ddc9234385317c4ee83bda087e389235c4a182736fc597565042f7644

• f0fec3b271b83e23ed7965198f3b00eece45bd836bf10c038e9910675bafefb1

• e7b29611c789a6225aebbc9fee3710a57b51537693cb2ec16e2177c22392b546

• 9ca5b2cbc3677a5967c448d9d21eb56956898ccd08c06b372c6471fb68d37d7d

• 318a1ebc0692d1d012d20d306d6634b196cc387b1f4bc38f97dd437f117c7e20

IPv4 Addresses

• 188[.]208[.]141[.]196

• 146[.]70[.]29[.]229

• 123[.]253[.]34[.]44

Domain

• www[.]slickvpn[.]com

URL

• hxxp[:]//118[.]174[.]183[.]89/kptinfo/import/index[.]php

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1091 (Replication Through Removable Media)

• Execution: T1059 (Command & Scripting Interpreter), T1204 (User Execution), T1140 (Deobfuscate/Decode Files)

• Persistence: T1547 (Boot or Logon Autostart), T1547.001 (Registry Run Keys/Startup Folder), T1053 (Scheduled Task/Job)

• Privilege Escalation & Defense Evasion: T1574 (Hijack Execution Flow), T1574.001 (DLL Sideloading), T1036 (Masquerading), T1070 (Indicator Removal), T1027 (Obfuscated Files/Information)

• Discovery: T1082 (System Information Discovery), T1012 (Query Registry)

• Command & Control: T1071 (Application Layer Protocol), T1090 (Proxy), T1105 (Ingress Tool Transfer)

• Impact: T1656 (Impersonation)

References

• IBM X-Force – Hive0154 Drops Updated Toneshell Backdoor

• HivePro – Chinese APT Earth Preta Runs Spearphishing Campaigns