[mustang-panda]

August 16, 2026

• Mustang Panda's CoolClient goes kernel-mode — researchers discovered a rootkit variant of the CoolClient implant, using a kernel-mode driver, in victims across Pakistan, Mongolia, Myanmar, and Russia. @frdfzi via @cyb3rops · Threat Activity

in Bring Your Own EDR: Turning a Commercial Endpoint Agent Into a Trojan Horse

June 30, 2026

• Mustang Panda is running two campaigns against Indian government and hydropower targets, abusing Zoho WorkDrive as a legitimate-cloud command channel, per Acronis. The Hacker News · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List