Trapping a Mustang Panda

China-aligned espionage group ITG27 (Mustang Panda) has intensified its targeting of India’s energy sector, leveraging advanced phishing, custom malware like Claimloader and Toneshell v10, and a newly discovered VNC backdoor (Havencode) to conduct hands-on reconnaissance and data exfiltration, underscoring the urgent need for robust, multi-layered cyber defenses against evolving state-sponsored threats.