A Close Look under the DNS Hood of CoolClient Securelist uncovered a new HoneyMyte campaign that uses an updated CoolClient backdoor to deploy browser login stealers and multiple data-theft and reconnaissance scripts. Researchers refined the initial CoolClient network IoCs to six verified indicators (three domains, two subdomains, one IP) and identified additional related artifacts including 57 email-connected domains and two IPs linked to malicious activity. #HoneyMyte #CoolClient

HoneyMyte upgraded the CoolClient backdoor in 2025, deploying browser login stealers and advanced data theft scripts. Researchers identified 6 network IoCs and 57 email-related domains linked to this campaign. #HoneyMyte #DataTheft #China

Il codice non mente: i legami segreti tra i gruppi hacker HoneyMyte e Mustang Panda

📌 Link all'articolo : www.redhotcyber.com/post/il-...

#redhotcyber #news #cyberspionaggio #hacking #malware #cybersecurity #minacceinformatica #honeymyte

HoneyMyte hackers upgrade CoolClient malware to steal browser credentials. Government agencies in Asia and Europe targeted. Stay vigilant! #CyberSecurity #HoneyMyte #CoolClient #MalwareAlert Link: thedailytechfeed.com/honeymyte-gr...

HoneyMyte updated CoolClient to sideload via Sang.exe using libngs.dll to decrypt loader.dat and main.dat; supports keylogging, TCP tunneling, plugin staging, and newer variants drop a rootkit (observed in Pakistan/Myanmar). #CoolClient #HoneyMyte #malware https://bit.ly/4t2kYAd

Mastang Panda Uses Venezuela News to Spread LOTUSLITE Malware Researchers have found a new spying campaign using news about Venezuela to trick US government officials. Learn how the LOTUSLITE virus sneaks into computers to steal secrets.

HoneyMyte (aka Mustang Panda) Deploys ToneShell Backdoor in New Attacks Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

HoneyMyte aka Mustang Panda is using a signed rootkit to drop the #ToneShell backdoor in ongoing attacks, hiding its activity from security tools and giving attackers remote access to system.

Read: hackread.com/honeymyte-mu...

#CyberSecurity #HoneyMyte #MustangPanda #Malware

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor Mustang Panda deployed TONESHELL via a signed kernel-mode rootkit, targeting Asian government networks and evading security tools.

HoneyMyte APT（又名Mustang Panda、Bronze President）使用内核态RootKit植入TONESHELL后门，攻击亚洲政府系统。
#中国 #恶意软件 #APT #MustangPanda #HoneyMyte

thehackernews.com/2025/12/must...

Original post on securityweek.com

Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor. The post Chinese APT Mus...

#Malware #& #Threats #China #APT #HoneyMyte #malware […]

[Original post on securityweek.com]