Mustang Panda Uses Zoho Work Drive as Command Channel in Indian Government Attacks

Summary: Acronis Threat Research Unit found active compromises inside Indian government networks, including machines used by senior administrative staff, from two Mustang Panda campaigns that abuse Zoho WorkDrive to pass commands and exfiltrate data. The campaigns arrived as ZIP archives with hidden malicious DLLs, likely via spear-phishing lures themed on a hydropower cooperation proposal and an India-Taiwan memorandum of understanding, with active beaconing running from June 12 to June 22, 2026.
What you should know: The command channel is a cloud storage service common in India's government sector, so the traffic looks like ordinary cloud activity and hides inside the network it is stealing from - and there is no patch to apply, only delivery and cloud abuse to catch.

Read the original at The Hacker News ↗