New CoolClient Malware Variant Targets Organizations Across Asia and Russia -

A new variant of malware capable of giving cyber attackers remote access to compromised systems has been detected in cyber-espionage operations targeting organizations and government entities in Pakistan, India, Myanmar, Mongolia and Russia.

According to a report by Kaspersky’s Global Research and Analysis Team (GReAT), researchers identified an updated version of CoolClient linked to the HoneyMyte advanced persistent threat (APT) group, also known as Mustang Panda. The malware was observed as part of a 2026 cyber-espionage campaign targeting organizations across Asia and Russia.

The latest CoolClient variant uses a digitally signed kernel driver, software that operates deep within the Windows operating system, to conceal the malware on infected devices. Researchers said the technique can make the malware more difficult to detect, investigate and remove.

In the observed attacks, the threat actor used PlugX, another backdoor commonly associated with initial compromises, to deliver components of CoolClient to targeted systems.

The malware is designed to maintain a low profile while protecting its files and registry entries from inspection or modification. It also enables attackers to maintain control over compromised devices.

Researchers found that the attackers established persistence by creating a scheduled task that automatically launched a file named defender.exe after a system restart, using the highest available local Windows privileges. The file then loaded a malicious library, triggering the CoolClient infection process.

Kaspersky GReAT security researcher Fareed Radzi said the technique could allow the malware to remain active on compromised systems while concealing important traces and making it harder for security teams to investigate or remove the infection. – ERMD

READ MORE