APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist reporting from late July to mid-August 2026 highlights multiple cyber-espionage and malware campaigns, including HoneyMyte’s CoolClient backdoor with a kernel-level Windows rootkit, Armored Likho’s Telegram-focused Still Toolkit, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN’s Google Apps Script and DNS-based C2, tailored Central Asian backdoors, cloud-hosted adversary-in-the-middle phishing bypassing MFA, and broader malware trends affecting PCs, mobile devices, IoT, and educational institutions.