2026-08-21 · view entry permalink →
UPDATE — Toneshell's tenth version abandons custom sockets for WebSocket-over-TLS through WinHTTP, retiring every network signature built on the old channel, and a new hVNC backdoor carries no embedded C2 at all
UPDATE · originally covered Mustang Panda's CoolClient backdoor gains a kernel driver signed with a 2013 certificate that expired in 2014 — and it hides the malware's own C2 traffic by hooking the driver Windows uses to report network state (2026-08-15)
this pipeline covered a CoolClient variant attributed to this actor six days ago, installing a signed kernel driver that filtered its own C2 addresses out of the network data Windows returns to user mode. This is separate research on the same actor from a different lab, and the reason it is worth an update rather than nothing is that one of its two findings retires existing detection content.
Toneshell v10 changes the channel, not just the payload. "Earlier variants relied on custom socket-based communications, while version 10 transitions to secure WebSocket communications using WinHTTP over TLS" (IBM X-Force, 2026-08-20). The implant now speaks through the operating system's own WinHTTP WebSocket routines and additionally queries the user's proxy configuration, so it is proxy-aware. The consequence for a network defender is direct: a signature or filter written against Toneshell's earlier bespoke socket protocol no longer matches anything, and what replaces it is traffic sharing port, protocol and TLS client-stack characteristics with every other WinHTTP-based Windows application and ordinary browser WebSocket session. Detection has to move to the client-stack TLS fingerprint, destination reputation, or endpoint-side visibility of the WebSocket API calls themselves — protocol shape alone no longer discriminates.
X-Force also found three standalone DLL builds of Toneshell v10 reusing the same WebSocket model, command dispatcher and reverse-shell functionality, two of them masquerading under the filename of a PDF-creation component and one as a browser-framework library. Between the dispatcher's command branches sit repeated blocks of wide-character junk strings referencing Harry Potter characters and themes — padding inserted to frustrate analysis.
Havencode: hidden desktop access with nothing to extract from the binary. X-Force had not previously observed this backdoor. Its centre of gravity is hidden Virtual Network Computing, letting an operator connect to an infected machine's desktop and browse it covertly. It ships as a 64-bit DLL alongside a legitimate signed executable and is launched by side-loading, and it takes three modes: a hidden-desktop VNC server on a supplied local port, a view-only mode that attaches to the user's existing desktop to watch without taking input control, and a generic TCP/UDP tunnel the operators used to relay the local VNC server's traffic out to their C2 — though X-Force notes the tunnel may serve any other proxy traffic too.
The detail that matters for hunting is what the file does not hold: "It does not contain any embedded C2 addresses. Instead, the C2 server is provided as command line argument at the time of execution". Static extraction of infrastructure from a recovered sample yields nothing; the address exists only in the process command line at launch, which makes process-creation telemetry with full command-line capture the difference between knowing where it called home and not.
The loader in front of it, which X-Force names Claimloader, copies the side-loading pair into a new installation directory — commonly under the system-wide program-data path — establishes persistence, then recovers embedded shellcode and executes the Toneshell payload by abusing a locale-enumeration API as a callback to transfer execution.
What the deception environment showed that logs would not. X-Force ran two fake victims — an operational technology company specialising in electric grids, and a state-level government agency — and captured the operators live. The evidence of hands-on-keyboard work is mundane and convincing: two commands were mistyped in both incidents, a domain-enumeration command and a wireless-network listing, and on its first attempt the crew launched Havencode with malformed arguments. X-Force's conclusion is that "This evidence is a strong indicator that most of the operator activity was not scripted but performed by hand", corroborated independently by timing — operator-initiated actions fell exclusively within weekday working hours of 08:00 to 18:00 China Standard Time, with activity pausing over a weekend and resuming afterwards. Initial access in the campaign came from a May 2026 email to Indian government recipients carrying a PDF attachment themed as a hydropower cooperation study and imitating Nepal's foreign ministry.
Triage: the side-load pair is the most reliable host-side discriminator, because the legitimate executable is genuinely signed and will pass any signature check — what is anomalous is that binary running from a program-data subdirectory rather than its installed location, with a same-named dependency DLL beside it. For Havencode specifically, look for a process whose command line carries a network address and a local port together with VNC-style mode arguments: the configuration is in the command line by design, so command-line logging is not optional here. On the network side, the honest position is that Toneshell v10's channel is hard to separate from benign WinHTTP WebSocket traffic; the tractable signals are a hidden-desktop VNC session being tunnelled out of a host that has no remote-support tooling deployed, and a rapid sequence of host and network reconnaissance commands — system information, current user, group enumeration, network connections and process listing in quick succession — which X-Force names as the pattern to alert on.
Earlier variants relied on custom socket-based communications, while version 10 transitions to secure WebSocket communications using WinHTTP over TLS.
It does not contain any embedded C2 addresses. Instead, the C2 server is provided as command line argument at the time of execution
This evidence is a strong indicator that most of the operator activity was not scripted but performed by hand.
The observed activity extends a campaign previously reported by Acronis, where ITG27 targeted India's energy sector and government organizations.
Builds on: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack