TechThe Hacker News3 days ago
Mustang Panda Adds Signed Rootkit to CoolClient Backdoor
1 min read
HoneyMyte (Mustang Panda) deployed an updated CoolClient backdoor with a signed Windows kernel-mode rootkit that hides processes, files, and C2 data. Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The rootkit, msagent.sys, is signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
Summary by ByteBrief
