APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

The HoneyMyte APT group has significantly evolved its CoolClient backdoor, now incorporating a kernel-mode driver for enhanced stealth and data exfiltration. The latest variant, observed in campaigns targeting countries like Myanmar, utilizes a signed driver to hide the CoolClient process, protect related files, and intercept network traffic. The group employs a multi-stage execution chain, including DLL sideloading, process injection into synchost.exe, and UAC bypass techniques to maintain elevated privileges and evade detection. They use a combination of techniques, including RPC-based process creation and parent process ID (PPID) spoofing, to achieve persistence and maintain a low profile.