MEDIUMApt
Global

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

·Source: Securelist (Kaspersky)

Updated:

Executive Summary

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Analysis

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Source Attribution

Originally published by Securelist (Kaspersky) on Aug 14, 2026.

Related Threats

MEDIUMApt

China-Linked APT Uses AI to Optimize Hand-Built Malware

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/china-linked-apt-uses-ai-to-optimize-hand-built-malware-image_small-4-a-32597.jpg" align=right hspace=4><b>SilkParasite Deployed Against Central Asian Governments</b><br>Bitdefender said the China-linked SilkParasite espionage campaign deployed seven modular RATs against Central Asian governments, with coding artifacts indicating

Bank Info Security
MEDIUMApt

'Living Off the Plant' OT Attacks Pose Physical Safety Risk

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/living-off-plant-ot-attacks-pose-physical-safety-risk-image_small-5-a-32591.jpg" align=right hspace=4><b>Beware Abuse of Native OT Functionality, Says Orange Cyberdefense's Ric Derbyshire</b><br>Attackers can employ "living off the plant" tactics to stealthily access and move laterally inside industrial networks, abusing native fu

Bank Info Security
CRITICALApt

CISA Malcolm

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.</strong></p> <p>The following versions of CISA Malcolm are affected:</p> <ul> <li>Malcolm <26.0

CVE-2026-55676CVE-2026-63133
CISA Advisories