negativeSYS.SOURCE: The Hacker News• 2026-08-14T18:38:56+05:30
Mustang Panda Enhances CoolClient Backdoor with Signed Windows Kernel Rootkit
Mustang Panda (HoneyMyte) has integrated a signed Windows kernel-mode rootkit into the CoolClient backdoor, enhancing its stealth capabilities by hiding processes, files, and C2 communications. The rootkit uses IOCTL requests for user-mode communication and employs filesystem, registry, and process protection mechanisms.
The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.
Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,
*** END OF TRANSMISSION ***