APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reporting from late July to mid-August 2026 describes multiple cyber-espionage and malware developments, including HoneyMyte’s CoolClient kernel-mode rootkit, Armored Likho’s Still Toolkit for Telegram theft and eavesdropping, Head Mare exploitation of unpatched TrueConf servers to deliver PhantomCore and PhantomGraph, Project CAV3RN’s Google Apps Script and DNS-based C2, and memory-resident OctLurk and SilkLurk backdoors targeting Central Asia. Additional coverage addresses MFA-bypass phishing through legitimate cloud platforms, Kerberoasting and DNS tunneling detection,