signed rootkit

Mustang Panda Deploys Signed Windows Rootkit with Updated CoolClient Backdoor

Kaspersky reports that the threat actor known as Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit. The rootkit is capable of hiding malicious processes, files, registry objects, and C2 network information from detection. Victims have been identified in Myanmar, Mongolia, and Pakistan, though the full scope and infection vectors remain under investigation.