Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,

Report facts: The HoneyMyte/Mustang Panda threat group is deploying an updated CoolClient backdoor alongside a signed Windows kernel-mode rootkit that hides and protects malicious processes, files, registry objects, and C2 network information, with victims identified in multiple Asian countries. RealGround analysis: While the campaign targets traditional Windows systems rather than AI directly, similar stealthy rootkit techniques could be used to tamper with AI infrastructure, exfiltrate AI models, or covertly manipulate data feeding AI systems. Organizations running critical AI workloads on Windows hosts should apply robust EDR, kernel integrity monitoring, and regular compromise assessments to ensure their AI environments are not silently subverted by such rootkit-backed malware.