Breaches and incidents
Indian government and hydropower sector (India): Mustang Panda uses Zoho WorkDrive as C2 in active compromises
Acronis TRU found active compromises of Indian government systems, including machines tied to senior administrative staff, beaconing 12 to 22 Jun 2026.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Acronis TRU found active compromises of Indian government systems, including machines tied to senior administrative staff, beaconing 12 to 22 Jun 2026. Lures: “Hydropower Cooperation Project Proposal.zip” and “MOU USI-INDSR TAIWAN.zip”.
- Technique: spear-phishing ZIPs with hidden DLLs sideloaded by signed Solid PDF Creator and Citrix binaries (SHARDLOADER v1.0/v1.1), dropping MINIRECON (Toneshell-derived, WebSocket over HTTPS) or ZOHOMURK, which uses hard-coded Zoho OAuth credentials to read commands from and write stolen data to an attacker WorkDrive account.
- Attacker: Mustang Panda (China-aligned), high confidence per Acronis; assessed goal is intelligence on India’s hydropower plans and defence ties with Taiwan.
- Response: Acronis worked with CERT-In on victim notification and remediation.