Threat Actor Activity29 Aug 2026·1 source
HoneyMyte adds kernel-mode rootkit to CoolClient backdoor
Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.
HoneyMyteMustang PandaCoolClient+3
