Reported by 3 outlets

Timeline

1. original reporting

   APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

   malware.news · 60d ago · August 14th, 2026

   Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023 , CoolClient has continued to evolve. In 2025 , we analyzed a newer variant that introduced clipboard theft and HTTP traffic interception for credential harvesting. In late 2025 and 2026, our latest investigation reveal another major evolution. The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified. The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell , but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor

2. update from cyberpress.org

   HoneyMyte CoolClient Rootkit Hooks Windows Nsiproxy to Conceal C2 Addresses

   cyberpress.org · 57d ago · August 17th, 2026

   The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode rootkit that hides command-and-control (C2) infrastructure on compromised Windows systems. The new capability marks a major shift for the malware, which was previously known mainly as a user-mode espionage tool. Recent attacks were observed in Myanmar, Mongolia, Pakistan, and Russia, including against government entities. Researchers found that HoneyMyte often uses PlugX as the initial implant after a breach. PlugX then helps deploy CoolClient and its supporting files. Before installing the malware, the attackers add Microsoft Defender exclusions for a fake Windows Defender directory and a renamed executable called defender.exe . The attackers copy files into a directory such as C:\Program Files\Microsoft\Windows Defender\ to make the installation look legitimate. They also abuse a valid Sangfor application, typically Sang.exe , rename it as defender.exe , and use it for DLL sideloading. When launched, the trusted program loads a malicious DLL named libngs.dll . Dummy export functions in libngs.dll invoking OutputDebugStringA and ExitProcess (Source: securelist) CoolClient creates persistence through a scheduled task and an AutoRun

3. update from gbhackers.com

   HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hide Malware and C2 Connections

   gbhackers.com · 57d ago · August 17th, 2026

   The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection […] The post HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hide Malware and C2 Connections appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .