APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reporting from late July to mid-August 2026 describes multiple cyber-espionage and malware campaigns, including HoneyMyte’s CoolClient backdoor with a kernel-level Windows rootkit, Armored Likho’s Telegram-stealing Still Toolkit, Head Mare exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph, Project CAV3RN’s Google Apps Script and DNS-based C2, and OctLurk/SilkLurk memory-resident backdoors targeting Central Asia. Additional reporting covers adversary-in-the-middle phishing that bypasses MFA through legitimate cloud platforms, Kerberoasting, a