CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions.
Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023, CoolClient has continued to evolve. In 2025, we analyzed a newer variant that introduced clipboard theft and HTTP traffic interception for credential harvesting.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Sri Lanka arrests over 230 Chinese in cybercrime raids
October 15, 2024
Sri Lankan police have arrested more than 230 Chinese men accused of targeting international banks in online scams, the foreign minister said on Tuesday (Oct 15), with help from security officials sent by Beijing. Vijitha Herath said police raids over the past week had also seized 250 computers and 500 mobile phones used in the alleged ...
- Fake attachment. Roundcube mail server attacks exploit CVE-2024-37383 vulnerability.
October 15, 2024
In September 2024, threat intelligence experts from the Positive Technologies Security Expert Center (PT ESC) discovered an email sent to a governmental organization belonging to a CIS country. Timestamps indicate that the email was sent back in June 2024. The email appeared to be a message without text, containing only an attached document. However, the email ...
- Whispers from the Dark Web Cave. Cyberthreats in the Middle East
October 14, 2024
The Kaspersky Digital Footprint Intelligence team analyzed cybersecurity threats coming from dark web cybercriminals who targeted businesses and governments in the Middle East in H1 2024. Our research highlights the most severe and pervasive threats, and identifies potential risks and consequences as well as defensive strategies. The five prevalent cybersecurity threats in the Middle East covered ...
- Cyber Attack Hits French Leading News Agency AFP
October 14, 2024
French news agency Agence France-Presse (AFP) suffered a cyber attack that disrupted its content delivery infrastructure and file transfer systems. It operates English, French, Arabic, Portuguese, and Spanish news channels and employs over 2,400 people in 150 countries. AFP said it was working to restore impacted systems and has engaged French cybersecurity agency ANSSI and law ...
- Chinese researchers break RSA encryption with a quantum computer
October 14, 2024
The research team, led by Wang Chao from Shanghai University, found that D-Wave’s quantum computers can optimize problem-solving in a way that makes it possible to attack encryption methods such as RSA. In a potentially alarming development for global cybersecurity, Chinese researchers have unveiled a method using D-Wave’s quantum annealing systems to crack classic encryption, potentially ...
- Pokémon hack exposes future games, beta designs and more
October 14, 2024
Pokémon developer Game Freak has confirmed its servers were hacked in August. The breach meant internal materials — from source codes to early and even scrapped character designs — were circulating on social media over the weekend. Leaked documents and images flooded Reddit and X after Centro Leaks began dumping it all on Saturday afternoon. It ...