Executive Summary
The Chinese-nexus threat group Mustang Panda (also known as Earth Preta, Bronze President, or Camaro Dragon) has significantly upgraded its toolkit for diplomatic espionage. Recent operations targeting Ministries of Foreign Affairs in the Philippines, Vietnam, Indonesia, and Malaysia have introduced two previously undocumented, memory-resident tools: ZOHOMURK and MINIRECON. These tools are specifically designed to evade EDR hooks and deep packet inspection firewalls by operating entirely in memory and utilizing unconventional network encapsulation.
The attack chain involves spear-phishing with malicious archives that lead to DLL side-loading through signed commercial security binaries. Once active, the malware performs rapid host reconnaissance and establishes encrypted SOCKS5 reverse tunnels using ICMP Echo Request steganography. This modular approach allows the adversary to maintain a minimal forensic footprint while monitoring high-value diplomatic cables and trade communiqués.
The shift toward memory-resident SOCKS5 proxies that lack local port bindings represents a tactical evolution, making traditional network monitoring less effective. Organizations in the diplomatic and defense sectors should prioritize auditing DLL load events and inspecting ICMP payloads for non-standard data patterns.