# Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURK

> Acronis TRU, working with CERT-In, uncovered two concurrent Mustang Panda espionage campaigns against Indian government and hydropower-sector entities. Hydropower-cooperation and India-Taiwan-MOU spear-phishing lures deliver the SHARDLOADER loader via DLL side-loading of signed Solid PDF Creator and Citrix Receiver binaries, staging the reworked Toneshell backdoor MINIRECON and the novel ZOHOMURK implant, which abuses a Zoho WorkDrive account as a command-and-control dead drop. Active beaconing was observed from multiple compromised Indian government systems, including machines belonging to senior administrative personnel.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2293
- **ID:** TL-2026-2293
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between June 12 and June 22, 2026, Acronis Threat Research Unit (TRU) observed two concurrent, technically related espionage intrusion sets against Indian government and hydropower-sector networks, attributed with high confidence to the China-aligned threat actor Mustang Panda (also tracked as TA416, RedDelta, Bronze President, Stately Taurus, Camaro Dragon, Earth Preta, Hive0154, Twill Typhoon, and ITG27/Hive0154 by IBM X-Force). Both campaigns began with spear-phishing ZIP archives — one themed as a hydropower-cooperation proposal, the other around an India-Taiwan memorandum of understanding — that conceal a malicious DLL alongside a legitimate, signed decoy executable. Running the signed binary (a repackaged 'Hydropower Cooperation Project Proposal.exe' in campaign one, a Citrix Receiver pcl2bmp.exe utility in campaign two) side-loads the malicious DLL (SolidPDFCreator.dll / pl2bmpax.dll in campaign one; ctxmui.dll / txMuiApp.dll in campaign two), which is the SHARDLOADER first-stage loader.

SHARDLOADER stages its payload from a hidden directory it creates at C:\ProgramData\IDM\logs, copying the legitimate executable and malicious DLL there. It reconstructs an obfuscated shellcode stub that has been fragmented across .rdata constants using rolling XOR and byte-reordering, allocates executable memory, and triggers execution via an EnumSystemLocalesA callback — a reflective, in-memory loading technique that avoids dropping the final payload to disk in cleartext. Persistence is established via a scheduled task named SolidPDFPcl2Bmp and a registry Run-key value consistently misspelled 'RunOnece' across both campaigns and prior Mustang Panda intrusions, an operational-security lapse that supports attribution.

SHARDLOADER deploys one of two second-stage implants. MINIRECON is a reworked variant of Mustang Panda's long-running Toneshell backdoor family (tracked by IBM X-Force since at least Q1 2021), functioning as a reverse-shell implant that beacons over a WebSocket connection tunneled through HTTPS via WinHTTP, disables TLS certificate validation, accepts self-signed certificates, and includes proxy fallback logic; it calls back to couldinstallup[.]com, which resolves to 199.209.141.166 — an IP block IBM X-Force has previously tied to Mustang Panda infrastructure. ZOHOMURK is a novel cloud-abusing implant that carries hardcoded Zoho OAuth credentials for an attacker-controlled Zoho WorkDrive account, using it as a command-and-control dead drop: the implant polls an 'inbox' folder for tasking, executes commands locally, and writes results/exfiltrated data to an 'outbox' folder, disguising its C2 traffic as legitimate cloud-sync activity via spoofed User-Agent strings ('Zoho Client/1.0', 'IPFetcher/1.0') and multipart POST requests, plus timing-based anti-analysis checks.

Victims included Indian government networks — including machines belonging to senior administrative personnel — and organizations in India's hydropower sector, consistent with an intelligence-collection objective around India's hydropower infrastructure and its defense/cooperation relationship with Taiwan. The activity followed an earlier April 2026 Mustang Panda campaign that used the LOTUSLITE tool against India's banking sector, indicating sustained targeting of India across sectors in 2026. Acronis TRU coordinated notification and remediation with India's CERT-In. Attribution to Mustang Panda is assessed at high confidence based on reuse of the Solid PDF Creator side-loading chain from prior campaigns, code overlaps with the established Toneshell family, C2 infrastructure geographically/AS-block correlated with prior IBM X-Force Mustang Panda tracking, the recurring 'RunOnece' misspelling across implants, and generally thin operational security (hardcoded OAuth tokens, plaintext identifiers).

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1021 Remote Services
- T1567 Exfiltration Over Web Service

## Sources

- [Mustang Panda targets India's government and energy sectors with SHARDLOADER, MINIRECON, and ZOHOMURK](https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/)
- [Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks](https://thehackernews.com/2026/06/mustang-panda-uses-zoho-workdrive-as.html)
- [Mustang Panda Targets India with ZOHOMURK and MINIRECON](https://socprime.com/active-threats/mustang-panda-uses-zohomurk-and-minirecon-against-indias-government-and-energy-sectors/)
- [Mustang Panda Targets India's Government and Energy Sectors With SHARDLOADER, MINIRECON, and ZOHOMURK](https://gbhackers.com/mustang-panda-targets-indias-government/)
- [Mustang Panda Abuses Zoho WorkDrive for Command-and-Control and Exfiltration](https://cybersecuritynews.com/mustang-panda-abuses-zoho-workdrive/)
- [Mustang Panda Exploits Zoho WorkDrive in Indian Government Attack](https://aviatrix.ai/threat-research-center/mustang-panda-indian-government-attack-2026/)
- [Mustang Panda (China-aligned) — CrowdStrike CQL Threat-Hunt Queries: ZOHOMURK/MINIRECON](https://slapopotamus.github.io/HuntPack/hunts/MustangPanda-ZOHOMURK-Hunt.html)
- [Trapping a Mustang Panda](https://www.ibm.com/think/x-force/trapping-a-mustang-panda)
- [Latest Mustang Panda Arsenal: ToneShell and StarProxy](https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1)
- [Mustang Panda, TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, Group G0129](https://attack.mitre.org/groups/G0129/)
- [TONESHELL, Software S1239](https://attack.mitre.org/software/S1239/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2293