Tag: ToneShell backdoor

HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns

Posted on

Over the past few years, we’ve been observing and monitoring the espionage activities of HoneyMyte (aka Mustang Panda or Bronze President) within Asia and Europe, with the Southeast Asia region being the most affected. The primary targets of most of Read More …

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Posted on

In mid-2025, Kaspersky researchers identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to Read More …