APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
2026-08-18T20:51:47Z•d24a6dc42a1eac4712742aec574db55784e26c98c7209550b803dda32ee65327
APTAiTMArmored-LikhoCoolClientDNS-C2DNS-tunnelingGoogle-Apps-Script-C2Head-MareHoneyMyteKerberoastingMFA-bypassPhantomCorePhantomGraphStill-ToolkitTelegram-data-theftTrueConfcloud-phishingcredential-dumpingcyber-espionagekernel-rootkitkeyloggingmemory-resident-malware
What happened
Kaspersky Securelist reporting from July–August 2026 describes multiple cyber-espionage and malware campaigns, including HoneyMyte’s CoolClient kernel-level rootkit, Armored Likho’s Telegram-stealing Still Toolkit, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN’s Google Apps Script and DNS-based C2, tailored Central Asian backdoors, and adversary abuse of legitimate cloud platforms for AiTM phishing and MFA bypass. The feed also includes broader threat statistics and defensive research on Kerberoasting and DNS tunneling. No specific CVE identifiers are provided in the ing
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- d24a6dc42a1eac4712742aec574db55784e26c98c7209550b803dda32ee65327
- Enrichment time
- 2026-08-18T20:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.