[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn4na9_aEBnENBpHLzKkrRwZiJhwUyWp-U9WNSqmT-vM":3},{"article":4,"iocs":51,"watch_terms":74,"solutions":75,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"587b4e25-258f-4b7c-aa06-91e9201705a1","APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit","apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kernel-level-windows-9232cf","Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.","The HoneyMyte APT group has updated its CoolClient backdoor with a kernel-mode rootkit driver for enhanced stealth. This new variant, observed targeting countries in Asia, can hide malicious processes, files, and network connections from security tools. The group also employs techniques like adding exclusions to Microsoft Defender and using PlugX as an initial implant.","HoneyMyte APT group's CoolClient backdoor now includes a kernel-level Windows rootkit.","https:\u002F\u002Fsecurelist.com\u002Fhoneymyte-coolclient-driver-rootkit\u002F121028\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F12120025\u002Fhoneymyte-driver-overview_1-scaled.jpg","2026-08-14T09:00:14+00:00","2026-08-14T10:00:15.923108+00:00",9,[17,20,22,25],{"name":18,"type":19},"HoneyMyte","threat_actor",{"name":21,"type":19},"Mustang Panda",{"name":23,"type":24},"Microsoft Defender","product",{"name":26,"type":27},"Sangfor","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,55,58,62,65,68,71],{"type":32,"value":53,"context":54},"CoolClient","Backdoor family updated with kernel-mode rootkit",{"type":32,"value":56,"context":57},"PlugX","Used as initial post-compromise implant to deploy CoolClient",{"type":59,"value":60,"context":61},"mitre_attack","T1055","Process Injection into synchost.exe",{"type":59,"value":63,"context":64},"T1547.001","Scheduled task for AutoRun persistence",{"type":59,"value":66,"context":67},"T1071","IOCTL command dispatcher for driver communication",{"type":59,"value":69,"context":70},"T1059.003","Command execution via wmic for Defender exclusions",{"type":59,"value":72,"context":73},"T1574.002","DLL Side-Loading (renaming Sangfor executable to defender.exe)",[26,23],{"controls":76,"vendors":160},[77,105,131],{"slug":78,"name":79,"problem":80,"products":81},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[82,89,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":78,"product_name":86,"url":87,"description":88},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":127,"product_name":128,"url":129,"description":130},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":132,"name":133,"problem":134,"products":135},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[161],{"slug":119,"name":120,"logo_path":121,"roles":162},[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"honeymyte-apt-deploys-kernel-level-rootkit-to-evade-detection","HoneyMyte APT Deploys Kernel-Level Rootkit to Evade Detection","The HoneyMyte APT group has significantly raised the bar for evasion by equipping its CoolClient backdoor with a kernel-mode rootkit driver, allowing it to conceal processes, files, and network activity from security tooling at the operating system's deepest level. By also disabling Microsoft Defender exclusions and leveraging PlugX as an initial foothold, the group demonstrates a sophisticated, layered intrusion methodology. This matters because kernel-level implants are exceptionally difficult to detect with traditional endpoint security tools, and their persistence can survive standard remediation steps. Organizations relying solely on user-mode security controls are effectively blind to this class of threat, underscoring the critical need for deeper visibility and hardened kernel integrity mechanisms.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1547.006: Boot or Logon Autostart – Kernel Modules and Extensions","NIST CSF DE.CM-4: Malicious Code Detection",{}]