Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a new version of the CoolClient backdoor being used in a 2026 cyber-espionage campaign targeting organizations and government entities in Pakistan, India, Myanmar, Mongolia, and Russia.
The malware has been attributed to HoneyMyte, also known as Mustang Panda, and gives attackers remote access to compromised Windows computers.
Kaspersky said the latest CoolClient version has been significantly upgraded and now uses a signed kernel driver to operate at a deeper level of Windows. This makes the malware harder for security teams to detect, investigate, and remove.
In the campaign, attackers used PlugX, another backdoor associated with the group, to deliver CoolClient components after gaining initial access to targeted systems.
The attackers also modified Microsoft Defender settings to exclude a specific folder and file from security scans. They created a fake Windows Defender directory and stored the malicious CoolClient files inside it.
A legitimate Sangfor application was renamed “defender.exe” and used to load the malicious code. The attackers then created a scheduled task to automatically run the renamed program at system startup with the highest available local Windows privileges.
According to Kaspersky Security Researcher Fareed Radzi, the updated CoolClient can hide processes, files, and registry objects and filter certain network information.
The use of a kernel-mode driver gives the malware greater control over compromised systems and helps it conceal important traces, making it more difficult for defenders to investigate or remove the threat.
Kaspersky GReAT has urged organizations to monitor for indicators linked to HoneyMyte and the tools used in the campaign. It also recommended strengthening real-time protection, threat detection, investigation, and response capabilities.
Organizations without dedicated cybersecurity teams were advised to consider managed security services that provide threat identification, detection, response, and remediation.
