Unit 42 documented in a report published on Unit 42 (Palo Alto Networks) a cluster of cyberespionage activity (CL-STA-0044) attributed with moderate-high confidence to Stately Taurus (Mustang Panda, BRONZE PRESIDENT, TA416, RedDelta, Earth Preta) targeting a Southeast Asian government from at least Q2 2021 through Q3 2023. The operation focused on continuous intelligence collection — exfiltrating sensitive documents and personal files from targeted individuals — rather than a single extraction, supported by multiple backdoors, web shells, and persistent archiving scripts.
Reconnaissance and Credential Theft: LadonGo, AdFind, Hdump, DCSync, and Ntds.dit
Reconnaissance used LadonGo (Chinese-developed open-source scanning framework for smbscan/pingscan/sshscan), NBTScan (NetBIOS name scanning), AdFind (renamed a.logs, saving results to Domain_users_light.txt, Domain_computers_light.txt, Domain_groups_light.txt), and Impacket for remote machine and directory discovery. Credential theft employed Hdump (renamed h64.exe) for memory credential dumping with the -a flag, Mimikatz (renamed l.doc) for LSASS memory extraction, DCSync via Mimikatz to simulate a domain controller and retrieve credentials (saved to log.txt), and Vssadmin to create a volume shadow copy of C:\ to retrieve the Ntds.dit database and the SYSTEM boot key — providing complete Active Directory credential access. The threat actor also abused ESET's Remote Administrator Agent (ERAAgent.exe) to execute reconnaissance batch files matching the pattern ra-run-command-[UUID].bat and drop additional backdoors.
Three-DLL ToneShell Variant: Component Architecture via DLL Sideloading and Pipes
An undocumented ToneShell variant departs from the prior shellcode-based version by distributing functionality across three DLL components, each sideloaded into a separate legitimate process and communicating via named pipes. The persistence component (nw.dll/nw_elf.dll) sideloads into Trend Micro Password Manager's PwmTower.exe, creating either a service (DISMsrv) and scheduled task (TabletPCInputServices/TabletInputServices) with elevated privileges, or a registry Run key plus scheduled task without. The networking component (rw32core.dll) sideloads into Embarcadero's resource compiler Brcc32.exe and handles C2 communication to www.uvfr4ep[.]com. The functionality component (secur32.dll) sideloads into Windows consent UI binary Consent.exe, supporting command execution, file system interaction, file upload/download, keylogging, and screen capture.
ShadowPad, China Chopper, and Cobalt Strike as Redundant Access Tools
ShadowPad was deployed via DLL sideloading — loading log.dll into renamed Bitdefender Crash Handler binary BDReinit.exe (as net.exe), which decrypts shellcode from log.dll.dat and injects into wmplayer.exe then dllhost.exe, with persistence as service DataCollectionPublisingService. China Chopper web shells provided fallback access when backdoors malfunctioned. A Cobalt Strike agent (libcurl.dll, sideloaded via Notepad++'s GUP.exe) was deployed briefly to recover malfunctioning backdoors and then promptly deleted.
Intelligence-Driven Targeting: wevtutil Event Log Hunting and Continuous Exfiltration
The threat actor used wevtutil to search Windows Security Event Log IDs 4624 (successful logins) and 4672 (sensitive privilege assignments) to identify which machines specific targeted individuals had logged into — then compromised those machines specifically to collect personal files. Exfiltration used rar.exe (executed remotely via Impacket and RemCom on uncompromised hosts) to archive files by extension or full directory, with an autorun.vbs archiving script persisted in the startup directory to ensure continuous data staging on re-login. Exfiltration methods included curl/FTP to ftp.1fichier[.]com and Dropbox API uploads.