A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.

Its Copy-on-Write ensures my data remains untouched even during failed write operations, while checksums and scrub tasks can ...