APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reporting highlights active APT and cyber-espionage campaigns in August 2026, including a kernel-level Windows rootkit, Telegram surveillance malware, exploitation of unpatched TrueConf servers, cloud-service C2 relays, DNS-based command-and-control, MFA-bypassing adversary-in-the-middle phishing, and memory-resident backdoors capable of credential theft, network discovery, shell execution, and keylogging. The collection also includes broader quarterly threat statistics and incident-response analysis.