HOMETHREATSTONESHELL
APT / THREAT GROUP

TONESHELL

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.toneshell

Threat Analysis

TONESHELL is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning TONESHELL

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
Securelist (Kaspersky)· Dec 29, 2025

External References

→https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/
→https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/
→https://github.com/Still34/landing/blob/master/assets/slides/2024-08-Sailing%20the%20Seven%20SEAs.pdf
→https://hitcon.org/2024/CMT/slides/Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf
→https://hunt.io/blog/toneshell-backdoor-used-to-target-attendees-of-the-iiss-defence-summit

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.toneshellTONESHELL

External Intelligence

Malpedia: win.toneshell

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search TONESHELL