Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
HoneyMyte CoolClient Rootkit Hooks Windows Nsiproxy to Conceal C2 Addresses
Malware Families
Excerpt
The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode rootkit that hides command-and-control (C2) infrastructure on compromised Windows systems. The new capability marks a major shift for the malware, which was previously known mainly as a user-mode espionage tool. CoolClient has been linked to HoneyMyte campaigns targeting organizations across Asia and Russia. The backdoor supports keylogging, clipboard theft,…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 9460e150e1981d5c165043520c5c12fe | High | Score 56/100 | First seen |
| MD5 | 2d7c8780e97409770a9d4f31c66c9d63 | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…