Dangerous Malware is Targeting Govt and Organizations in Pakistan

A new, advanced version of the CoolClient backdoor is being used in a 2026 cyber-espionage campaign, targeting government entities and organizations in Myanmar, Mongolia, Pakistan, India, and Russia, according to Kaspersky Global Research and Analysis Team (GReAT). This malware, linked to the threat actor group HoneyMyte or Mustang Panda, provides attackers with remote access to compromised Windows systems.

The latest CoolClient variant stands out by using a signed kernel driver, making it harder to detect and remove. During the observed campaign, attackers employed PlugX, another backdoor, to deliver CoolClient components to targeted systems. To avoid detection, the attackers configured Microsoft Defender to exclude specific folders and files, created a fake Windows Defender directory, and placed CoolClient files inside it.

They also renamed a legitimate Sangfor program to "defender.exe" to load malicious code. Kaspersky Security Researcher Fareed Radzi explained that this new CoolClient variant can hide and protect processes, files, and registry objects while filtering network information and remaining active on compromised systems, masking important traces and limiting defenders' ability to inspect or remove it.

Kaspersky GReAT advises organizations to stay vigilant against HoneyMyte indicators of compromise and related tools, strengthen real-time protection, enhance threat visibility, and improve investigation and response capabilities. They also recommend using threat intelligence for early risk identification. For organizations lacking cybersecurity expertise, managed security services covering threat identification, detection, response, and remediation are suggested.