Loading story…
The HoneyMyte advanced persistent threat (APT) group, also known as Mustang Panda or Bronze President, has been observed deploying a new kernel-mode rootkit to deliver the ToneShell backdoor in targeted attacks against government organizations in Southeast and East Asia. The malicious driver, registered as a mini-filter and signed with a stolen or leaked digital certificate, is designed to inject the ToneShell backdoor into system processes while protecting malicious files, user-mode processes, and registry keys from detection or removal. The campaign, active since at least February 2025, primarily targets entities in Myanmar and Thailand, with evidence suggesting that affected victims had previously been compromised by other HoneyMyte tools such as the ToneDisk USB worm, PlugX, and earlier ToneShell variants.
Technical analysis reveals that the rootkit, named ProjectConfiguration.sys, embeds user-mode shellcodes and leverages advanced evasion techniques, including runtime API resolution and interception of file-system operations to prevent deletion or renaming of its components. The ToneShell backdoor provides attackers with a reverse shell and persistent access to compromised systems, facilitating cyberespionage activities. Command-and-control infrastructure for this campaign was registered in late 2024, and the operation demonstrates a continued evolution in HoneyMyte's toolset and tactics, underscoring the persistent threat posed by this state-sponsored actor to high-profile organizations in the region.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed that the rootkit tampered with Microsoft Defender's WdFilter altitude to block its loading and used API hashing, interception of file and registry operations, and process-handle stripping to evade detection. Researchers also described the updated ToneShell's new host identification, traffic obfuscation, and expanded remote command capabilities.
Analysis of the malware and telemetry tied the new ToneShell variant and its first observed kernel-mode delivery method to the HoneyMyte APT, also known as Mustang Panda or Bronze President. The findings marked an escalation in the group's stealth and resilience techniques.
By mid-2025, researchers identified a malicious certificate-signed Windows mini-filter driver, ProjectConfiguration.sys, on systems in Asia. The driver acted as a rootkit-style loader that protected malicious files, registry keys, and processes while injecting a new ToneShell backdoor variant into system processes.
Researchers assess the espionage campaign began around February 2025, primarily targeting government organizations in Southeast and East Asia, especially Myanmar and Thailand.
Infrastructure later tied to the HoneyMyte/Mustang Panda campaign was registered through NameCheap in September 2024, laying the groundwork for subsequent operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcesecurelist.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HoneyMyte, also tracked as Mustang Panda, has deployed a new 2025–2026 variant of its **CoolClient** backdoor that adds a signed Windows kernel-mode driver, `msagent.sys`, to deepen stealth and persistence during espionage intrusions. Researchers said the malware retains its multi-stage DLL sideloading design but now uses rootkit functions to hide and protect malicious processes, files, and registry objects, while also filtering network information linked to command-and-control infrastructure through an `Nsiproxy` hook. In one intrusion targeting Myanmar, the group reportedly used **PlugX** as an initial implant before installing CoolClient from a fake Windows Defender directory via a renamed legitimate Sangfor executable. The malware persists through AutoRun entries, scheduled tasks, and Windows services, injects into `synchost.exe`, and can relaunch itself with elevated privileges using an RPC-based UAC bypass with PPID spoofing. Victims were identified in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, indicating HoneyMyte is expanding kernel-level defense evasion in post-compromise operations.
Aug 18, 2026Mustang Panda, a China-aligned APT group, has deployed updated variants of the ToneShell backdoor in targeted attacks against Myanmar and other Southeast Asian countries. The latest variants feature enhanced anti-analysis techniques, hybrid communication protocols, and are delivered via DLL sideloading in compressed archives. These campaigns reflect China's ongoing use of cyber operations to maintain geopolitical influence in the region.
Jun 30, 2026
Kaspersky reported that the China-aligned espionage group **Mustang Panda** (aka **HoneyMyte** / **Bronze President**) has updated its *CoolClient* backdoor, adding capabilities to steal browser login data and monitor the clipboard, alongside broader enhancements to its data theft and reconnaissance tooling. The activity has primarily targeted **government entities**, with observed campaigns affecting Myanmar, Mongolia, Malaysia, and Russia (with additional reporting noting targeting in Pakistan), and CoolClient often appearing as a **secondary backdoor** alongside **PlugX** and **LuminousMoth**. The updated intrusion chain commonly relies on **DLL sideloading** using legitimate signed executables to load malicious DLLs, with CoolClient delivered via encrypted loader components and multi-stage execution using encrypted `.DAT` files (e.g., `main.dat`). Reported functionality includes host and user profiling, file operations, keylogging, TCP tunneling, reverse-proxying, and in-memory execution of fetched plugins, with persistence achieved through **Registry modifications**, creation of **Windows services**, and **scheduled tasks**, plus support for **UAC bypass** and privilege escalation. Kaspersky also noted CoolClient being deployed via legitimate software associated with *Sangfor* and stated the malware has been used to deploy a **previously unseen rootkit**, with further technical details expected in follow-on reporting.
Jun 29, 2026