APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

The HoneyMyte APT group has significantly raised the bar for evasion by equipping its CoolClient backdoor with a kernel-mode rootkit driver, allowing it to conceal processes, files, and network activity from security tooling at the operating system's deepest level. By also disabling Microsoft Defender exclusions and leveraging PlugX as an initial foothold, the group demonstrates a sophisticated, layered intrusion methodology. This matters because kernel-level implants are exceptionally difficult to detect with traditional endpoint security tools, and their persistence can survive standard remediation steps. Organizations relying solely on user-mode security controls are effectively blind to this class of threat, underscoring the critical need for deeper visibility and hardened kernel integrity mechanisms.