[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fff89UUTYzPV_bBd1ghkWRB0Yr51py6NZO5qJCmBmfnk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":68},"d025b123-d1bf-40fd-9a1f-8c08cbbf6475","honeymyte-apt-deploys-kernel-level-rootkit-to-evade-detection","587b4e25-258f-4b7c-aa06-91e9201705a1","HoneyMyte APT Deploys Kernel-Level Rootkit to Evade Detection","The HoneyMyte APT group has significantly raised the bar for evasion by equipping its CoolClient backdoor with a kernel-mode rootkit driver, allowing it to conceal processes, files, and network activity from security tooling at the operating system's deepest level. By also disabling Microsoft Defender exclusions and leveraging PlugX as an initial foothold, the group demonstrates a sophisticated, layered intrusion methodology. This matters because kernel-level implants are exceptionally difficult to detect with traditional endpoint security tools, and their persistence can survive standard remediation steps. Organizations relying solely on user-mode security controls are effectively blind to this class of threat, underscoring the critical need for deeper visibility and hardened kernel integrity mechanisms.","**Immediate actions:**\n- Enable and enforce Windows Secure Boot and Kernel-Mode Code Signing (KMCS) policies to block unsigned or untrusted kernel drivers.\n- Audit Microsoft Defender exclusion lists immediately and alert on any programmatic changes to AV\u002FEDR configurations.\n- Deploy threat hunting queries targeting known PlugX and CoolClient indicators of compromise (IOCs) across all endpoints.\n\n**Detection measures:**\n- Implement an EDR solution with kernel-level telemetry (e.g., Microsoft Defender for Endpoint, CrowdStrike) capable of detecting rootkit behaviors and driver anomalies.\n- Enable Windows Event Logging for driver installation events (Event ID 7045) and alert on any unsigned or suspicious kernel driver loads.\n- Monitor for unexpected outbound network connections at the network perimeter, as rootkits hiding connections at the host level will still be visible at the network layer.\n\n**Long-term improvements:**\n- Enforce application allowlisting for kernel drivers using Windows Defender Application Control (WDAC) or equivalent policy.\n- Implement network segmentation to limit lateral movement opportunities if an initial PlugX implant achieves a foothold.\n- Establish a regular threat intelligence program to track APT group TTPs and proactively update detection rules based on evolving malware capabilities.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1547.006: Boot or Logon Autostart – Kernel Modules and Extensions","NIST CSF DE.CM-4: Malicious Code Detection",{},"published","2026-08-14T10:21:26.485421+00:00","2026-08-14T10:21:26.174+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fsecurelist.com\u002Fhoneymyte-coolclient-driver-rootkit\u002F121028\u002F","apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kernel-level-windows-9232cf","APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":45,"name":46,"slug":47,"description":48,"color":49},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[51,57,63],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"de2f9393-a59f-4e83-b26c-e24f4f2cec35","2026-08-16","morning","ThreatNoir Weekend Brief — August 16","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-16\u002Fthreatnoir-morning-brief-2026-08-16.mp3",{"id":58,"date":59,"edition":60,"title":61,"audio_url":62},"acf48443-f51b-4114-b185-1856d692fde2","2026-08-15","afternoon","ThreatNoir Weekend Brief — August 15","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-15\u002Fthreatnoir-afternoon-brief-2026-08-15.mp3",{"id":64,"date":65,"edition":60,"title":66,"audio_url":67},"53bba375-f6f2-4954-adc5-5e97e75754c0","2026-08-14","ThreatNoir Afternoon Brief — August 14","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-14\u002Fthreatnoir-afternoon-brief-2026-08-14.mp3",[69,73,77],{"slug":70,"name":71,"problem":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":74,"name":75,"problem":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":78,"name":79,"problem":80},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]