> TritonInfoSec News
Home / Aug 18, 2026 / Story
0
#8 The Hacker News general August 14, 2026 at 13:08 UTC

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

By [email protected] (The Hacker News)

AI Summary

Mustang Panda (HoneyMyte) has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit capable of hiding malicious processes, files, registry keys, and C2 network traffic, with victims identified in Myanmar, Mongolia, and Pakistan. The use of a legitimately signed rootkit significantly raises the bar for detection on affected endpoints.

Read full article → https://thehackernews.com/2026/08/mustang-panda-ad…

Relevance score: 76.0/100

# More from August 18

  1. 1
    Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware The Hacker News
  2. 2
    Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure SecurityWeek
  3. 3
    Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects The Hacker News
  4. 4
    Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads The Hacker News
  5. 5
    Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner The Hacker News
  6. 6
    Microsoft working on Defender patch for ShieldBreak zero-day BleepingComputer
  7. 7
    Certighost and the Privilege Hiding in Your Certificate Authority BleepingComputer
  8. 9
    Poland probes MyDr healthcare software breach potentially affecting 19 million people The Record
  9. 10
    Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups The Hacker News