THREAT OPS › Threat News › APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/12120025/honeymyte-driver-overview_1-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda)
Attributed threat actors
- Mustang PandaG0129
MITRE ATT&CK techniques
Indicators of compromise
- 2d7c8780e97409770a9d4f31c66c9d63md5
- 9460e150e1981d5c165043520c5c12femd5
- 9717f005c5fb98e08d2ad983d88f94eemd5
- f518d8e5fe70d9090f6280c68a95998fmd5
- eb79558b037669792652a816e2c669demd5
- https://www.sophos.com/en-us/blog/family-tree-dll-sideloading-cases-may-be-relatedurl
- https://www.trendmicro.com/en_gb/research/23/c/earth-preta-updated-stealthy-strategies.htmlurl
- https://projectzero.google/2019/12/calling-local-windows-rpc-servers-from.htmlurl
- https://opentip.kaspersky.com/2d7c8780e97409770a9d4f31c66c9d63/results?icid=gl_sl_post-opentip_sm-team_3d2039d9ddf06875&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/9460e150e1981d5c165043520c5c12fe/results?icid=gl_sl_post-opentip_sm-team_1754cb9aac41d888&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/9717f005c5fb98e08d2ad983d88f94ee/results?icid=gl_sl_post-opentip_sm-team_c30f96c7cf5856ea&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f518d8e5fe70d9090f6280c68a95998f/results?icid=gl_sl_post-opentip_sm-team_b16535e15acd18fd&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/eb79558b037669792652a816e2c669de/results?icid=gl_sl_post-opentip_sm-team_907db9c75a8f93ed&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/cloudtroe.giize.com/results?icid=gl_sl_post-opentip_sm-team_46cfbc40afb319eb&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/employers.theworkpc.com/results?icid=gl_sl_post-opentip_sm-team_9a23c78d913ea73c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/freeread.casacam.net/results?icid=gl_sl_post-opentip_sm-team_8ed3fd0a35ac0a13&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/us.lenovoappstore.com/results?icid=gl_sl_post-opentip_sm-team_c55e6265c7a1595b&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/sundanish.freeddns.org/results?icid=gl_sl_post-opentip_sm-team_a3d2102a9d5fd418&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/torinarlabs.webredirect.org/results?icid=gl_sl_post-opentip_sm-team_ef018f85e71c7ed0&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/news.dursamjbataar.org/results?icid=gl_sl_post-opentip_sm-team_ad0bbcc1b8571980&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/video.dursamjbataar.org/results?icid=gl_sl_post-opentip_sm-team_4254bf92cb3b508d&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/black-popular.com/results?icid=gl_sl_post-opentip_sm-team_4b2db7c804e10e0c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/whatismybestthing.com/results?icid=gl_sl_post-opentip_sm-team_87c1cc238e3f2fe3&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- media.kasperskycontenthub.comdomain
Original source: https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/