MEDIUMVulnerability
Global

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

·Source: The Hacker News

Updated:

Executive Summary

The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,

Analysis

The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,
Source Attribution

Originally published by The Hacker News on Aug 14, 2026.

Related Threats

MEDIUMVulnerability

Ingenico secures €150 million in fresh capital

Ingenico, a global leader in payment acceptance solutions, is proud to announce an agreement to reset its capital structure, anchored by a €150 million investment from a PIMCO-led group of global investors.

Finextra
MEDIUMVulnerability

Ebanx expands leadership team

EBANX, a global technology company specialising in payment services for emerging markets, today announced a significant expansion of its senior leadership team.

Finextra
MEDIUMVulnerability

Recent macOS Screen Sharing Vulnerability Exploited in Attacks

Threat actors gained root access to the vulnerable systems and deployed a Monero miner. The post Recent macOS Screen Sharing Vulnerability Exploited in Attacks appeared first on SecurityWeek .

SecurityWeek