HoneyMyte’s CoolClient gets a kernel‑level rootkit to hide its tracks
Security researchers uncovered a new CoolClient variant that installs a signed kernel‑mode driver as a Windows service, giving the backdoor the ability to cloak its process, files, registry keys and network connections. The upgrade, seen in attacks across Pakistan, Mongolia and Myanmar, raises the bar for evading endpoint defenses.