securelist.com· Aug 14, 2026· by Fareed Radzi

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#GReAT research#APT reports#Rootkits#Malware Technologies#Microsoft Windows#Targeted attacks#Malware Descriptions#APT

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

More Writeups Like This

Mirage Kitten targets Middle East and Africa region with new malware

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

Angry Birds: Toy Ghouls’ new toys

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery