Tag: yokai

3 Attack Reports | 0 Vulnerabilities

Attack reports

Updated Toneshell backdoor and novel SnakeDisk USB worm dropped

In mid-2025, China-aligned threat actor Hive0154 deployed new malware variants, including an updated Toneshell backdoor and a novel USB worm called SnakeDisk. Toneshell9 evades detection and supports C2 communication through local proxies. SnakeDisk only executes on devices in Thailand, propagating…
backdoor
espionage
china
toneshell
pubload
thailand
yokai
2025-09-11
usb worm
snakedisk
Published: September 11, 2025
Downloadable IOCs: 7

Chinese APT Target Royal Thai Police in Malware Campaign

A malware campaign targeting the Royal Thai Police has been identified, using seemingly legitimate FBI-related documents to deliver the Yokai backdoor. The attack, consistent with the Chinese APT group Mustang Panda, involves a RAR archive containing a shortcut file that executes ftp.exe to process…
apt
espionage
phishing
china
yokai
2025-02-26
Published: February 26, 2025
Downloadable IOCs: 0

New Yokai Side-loaded Backdoor Targets Thai Officials

A new backdoor named Yokai has been discovered targeting Thai officials. The malware is distributed via RAR files containing shortcut files that create decoy documents and execute a dropper. The dropper deploys a legitimate iTop Data Recovery application used to side-load the Yokai backdoor DLL. Yo…
backdoor
dropper
2024-12-16
thailand
yokai
Published: December 16, 2024
Downloadable IOCs: 20
Click here to see more Attack Reports