APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reporting highlights multiple 2026 cyber-espionage and malware campaigns, including HoneyMyte’s CoolClient kernel-level rootkit, Armored Likho’s Telegram-stealing Still Toolkit, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN’s Google Apps Script and DNS-based C2, MFA-bypass phishing hosted on legitimate cloud platforms, and tailored Central Asian backdoors capable of credential theft, network discovery, shells, and keylogging. The feed also includes broader threat-statistics and defensive-analysis reports.