HoneyMyte Adds Kernel Rootkit to CoolClient Backdoor

HoneyMyte adds kernel rootkit to CoolClient backdoor

Kaspersky says HoneyMyte, aka Mustang Panda, upgraded CoolClient with a signed kernel-mode rootkit used in government intrusions across Asia and Russia.

HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit to Hide Processes, Files and C2 Traffic

HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit for Windows. The change makes routine investigation much harder for defenders. It gives intruders tools designed to survive ordinary security checks. The activity targeted organizations in Pakistan, Mongolia, Myanmar and Russia, including government entities. In Myanmar, attackers first used PlugX, then installed CoolClient as a second backdoor. The sequence resembles Plu…

Windows rootkit now included with CoolClient backdoor targeting governments

The APT group HoneyMyte has updated its CoolClient backdoor with a kernel-level Windows rootkit to make detection harder. Here's what admins can do.

CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Since its first public disclosure by Sophos in 2022 and subsequent analysis by T…