Executive Summary
Acronis Threat Research Unit has identified two concurrent espionage campaigns orchestrated by Mustang Panda targeting Indian government entities and the hydropower sector. These campaigns, active through mid-2026, leverage legitimate lure documents themed around India-Taiwan cooperation and hydropower projects to deliver newly discovered malware toolkits including SHARDLOADER, MINIRECON, and ZOHOMURK.
The attack chain involves sophisticated DLL sideloading of legitimate binaries (e.g., Solid PDF Creator, Citrix Receiver) to deploy advanced implants. MINIRECON, a Toneshell-derived variant, utilizes WebSockets over HTTPS for command-and-control, while ZOHOMURK abuses the Zoho WorkDrive platform for stealthy data exfiltration and task management. These activities are assessed with high confidence to be state-aligned espionage aimed at intelligence collection related to critical infrastructure and diplomatic engagements.