APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reports multiple 2026 cyber-threat developments, including HoneyMyte’s kernel-level CoolClient rootkit, Armored Likho’s Telegram-stealing Still Toolkit, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN’s Google Apps Script and DNS-based C2, MFA-bypassing adversary-in-the-middle phishing on cloud platforms, and memory-resident espionage backdoors targeting Central Asia. The feed also includes quarterly threat statistics and defensive analyses covering Kerberoasting and DNS tunneling.