CoolClient backdoor goes deeper: Windows kernel rootkit added

Reported 14 Aug 2026 by otx · Severity: medium

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including pro