Mustang Panda Hides C2 Inside Zoho WorkDrive to Spy on India

The China-aligned espionage group Mustang Panda has been quietly working two campaigns against Indian government and hydropower targets, and the interesting choice is what they used as a command channel. Rather than build suspicious infrastructure, they sent instructions and pulled stolen data through Zoho WorkDrive, a cloud storage service in heavy use across Indian government departments. The traffic looks like ordinary cloud activity, which is exactly why it worked.

Acronis Threat Research Unit found live compromises on machines belonging to senior administrative staff and coordinated with CERT-In on notification and cleanup. The lures were specific: one offered a hydropower cooperation proposal, the other framed a memorandum of understanding between Indian and Taiwanese institutions. Both landed as ZIP archives hiding a malicious DLL, almost certainly delivered by spear-phishing. Active beaconing ran from 12 to 22 June 2026.

Attribution was the easy part

The operators left a clear trail. They reused the Solid PDF Creator sideloading chain, shared code with Toneshell, parked command servers in a network block IBM X-Force has previously tied to the group, and carried the same typo, RunOnece, across multiple implants. Hardcoded tokens and plaintext identifiers did the rest of the work for analysts.

This is not a one-off. In April, Acronis linked the group's LOTUSLITE backdoor to attacks on Indian banks and South Korean policy circles, also routed through a legitimate cloud service. China-linked interest in India's energy infrastructure goes back further still, to the 2021 RedEcho campaign against the electricity grid.

Why the cloud channel matters

Using a trusted SaaS platform as the command-and-control layer is not new, but it remains one of the harder things for a defender to spot. Outbound connections to Zoho from a government endpoint are not suspicious by default. Most monitoring tools are tuned to flag oddball domains and self-signed certificates, not chatter with a service the organisation actively pays for.

That puts the useful detection further up the chain. Two places, really:

• At delivery. The whole campaign hinges on someone opening a ZIP and running what's inside. Spear-phishing tailored to a specific policy file or bilateral agreement is exactly the kind of message a busy senior staffer is most likely to engage with.
• At behaviour. A non-browser process suddenly talking to a cloud API, or a scheduled task with a name no one recognises, is the kind of signal worth chasing.

Indicators worth checking

Acronis has published a set of indicators that defenders can plug straight into their tooling, including the SolidPDFPcl2Bmp scheduled task, the C2 domain couldinstallup[.]com, and Zoho user agents appearing on processes that have no business making web requests. Government and energy teams handling anything Beijing might find strategically useful are the obvious first places to look.

There is no patch here. The fix is awareness of how these lures arrive and attention to the bits of normal-looking cloud traffic that turn out not to be normal at all.