Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
Malware Families
Excerpt
Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023 , CoolClient…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | black-popular.com | High | Score 58/100 | First seen |
| Domain | cloudtroe.giize.com | High | Score 58/100 | First seen |
| Domain | torinarlabs.webredirect.org | High | Score 58/100 | First seen |
| Domain | us.lenovoappstore.com | High | Score 58/100 | First seen |
| Domain | news.dursamjbataar.org | High | Score 58/100 | First seen |
| Domain | sundanish.freeddns.org | High | Score 58/100 | First seen |
| Domain | freeread.casacam.net | High | Score 58/100 | First seen |
| Domain | whatismybestthing.com | High | Score 58/100 | First seen |
| MD5 | f518d8e5fe70d9090f6280c68a95998f | Medium | Score 53/100 | First seen |
| MD5 | 9717f005c5fb98e08d2ad983d88f94ee | Medium | Score 53/100 | First seen |
| Domain | video.dursamjbataar.org | High | Score 58/100 | First seen |
| MD5 | 9460e150e1981d5c165043520c5c12fe | High | Score 56/100 | First seen |
| MD5 | eb79558b037669792652a816e2c669de | Medium | Score 53/100 | First seen |
| MD5 | 2d7c8780e97409770a9d4f31c66c9d63 | High | Score 56/100 | First seen |
| Domain | employers.theworkpc.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…