Kaspersky experts discovered a new variant of the CoolClient backdoor, used by the APT group HoneyMyte, which now includes a kernel-mode rootkit driver. This advanced rootkit allows the malware to hide malicious processes, files, and network connections from security tools and analysts. The upgrade significantly enhances the persistence and stealth capabilities of HoneyMyte’s operations.