Skip to content
Threat Feed
Subscribe

Actor

HoneyMyte

2 briefs RSS
high threat

Mustang Panda Deploys Signed Kernel-Mode Rootkit with CoolClient Backdoor

The threat actor HoneyMyte (Mustang Panda) is utilizing a signed kernel-mode rootkit named msagent.sys to provide stealth capabilities for its CoolClient backdoor, facilitating process, file, and network hiding on compromised Windows systems.

Windows HoneyMyte rootkit backdoor espionage malware
3t 4i
high threat

HoneyMyte CoolClient Backdoor Updated with Kernel-Mode Rootkit

The HoneyMyte APT group has enhanced its CoolClient backdoor with a custom kernel-mode driver that hides malicious artifacts and activity from security software on Windows systems.

Endpoint Secure HoneyMyte backdoor rootkit apt windows espionage
1r 3t