Between June 12 and June 22, 2026, Acronis Threat Research Unit (TRU) observed two concurrent, technically related espionage intrusion sets against Indian government and hydropower-sector networks, attributed with high confidence to the China-aligned threat actor Mustang Panda (also tracked as TA416, RedDelta, Bronze President, Stately Taurus, Camaro Dragon, Earth Preta, Hive0154, Twill Typhoon, and ITG27/Hive0154 by IBM X-Force). Both campaigns began with spear-phishing ZIP archives — one themed as a hydropower-cooperation proposal, the other around an India-Taiwan memorandum of understanding — that conceal a malicious DLL alongside a legitimate, signed decoy executable. Running the signed binary (a repackaged 'Hydropower Cooperation Project Proposal.exe' in campaign one, a Citrix Receiver pcl2bmp.exe utility in campaign two) side-loads the malicious DLL (SolidPDFCreator.dll / pl2bmpax.dll in campaign one; ctxmui.dll / txMuiApp.dll in campaign two), which is the SHARDLOADER first-stage loader.

SHARDLOADER stages its payload from a hidden directory it creates at C:\ProgramData\IDM\logs, copying the legitimate executable and malicious DLL there. It reconstructs an obfuscated shellcode stub that has been fragmented across .rdata constants using rolling XOR and byte-reordering, allocates executable memory, and triggers execution via an EnumSystemLocalesA callback — a reflective, in-memory loading technique that avoids dropping the final payload to disk in cleartext. Persistence is established via a scheduled task named SolidPDFPcl2Bmp and a registry Run-key value consistently misspelled 'RunOnece' across both campaigns and prior Mustang Panda intrusions, an operational-security lapse that supports attribution.

SHARDLOADER deploys one of two second-stage implants. MINIRECON is a reworked variant of Mustang Panda's long-running Toneshell backdoor family (tracked by IBM X-Force since at least Q1 2021), functioning as a reverse-shell implant that beacons over a WebSocket connection tunneled through HTTPS via WinHTTP, disables TLS certificate validation, accepts self-signed certificates, and includes proxy fallback logic; it calls back to couldinstallup[.]com, which resolves to 199.209.141.166 — an IP block IBM X-Force has previously tied to Mustang Panda infrastructure. ZOHOMURK is a novel cloud-abusing implant that carries hardcoded Zoho OAuth credentials for an attacker-controlled Zoho WorkDrive account, using it as a command-and-control dead drop: the implant polls an 'inbox' folder for tasking, executes commands locally, and writes results/exfiltrated data to an 'outbox' folder, disguising its C2 traffic as legitimate cloud-sync activity via spoofed User-Agent strings ('Zoho Client/1.0', 'IPFetcher/1.0') and multipart POST requests, plus timing-based anti-analysis checks.

Victims included Indian government networks — including machines belonging to senior administrative personnel — and organizations in India's hydropower sector, consistent with an intelligence-collection objective around India's hydropower infrastructure and its defense/cooperation relationship with Taiwan. The activity followed an earlier April 2026 Mustang Panda campaign that used the LOTUSLITE tool against India's banking sector, indicating sustained targeting of India across sectors in 2026. Acronis TRU coordinated notification and remediation with India's CERT-In. Attribution to Mustang Panda is assessed at high confidence based on reuse of the Solid PDF Creator side-loading chain from prior campaigns, code overlaps with the established Toneshell family, C2 infrastructure geographically/AS-block correlated with prior IBM X-Force Mustang Panda tracking, the recurring 'RunOnece' misspelling across implants, and generally thin operational security (hardcoded OAuth tokens, plaintext identifiers).