← threat actors
threat actor · CN
MUSTANG PANDA
also tracked as honeymyte 1
3 stories · 2 in the wild · June 30, 2026 – August 16, 2026
evidence: 2 observed · 1 disclosed
sectors
- energy 1 · Jun 30
- government 1 · Jun 30
geography
- mongolia 1 · Aug 16
- myanmar 1 · Aug 16
- pakistan 1 · Aug 16
- russia 1 · Aug 16
- asia 1 · Aug 15
- india 1 · Jun 30
techniques
- rootkit 1 · Aug 16
- dll sideloading 1 · Aug 15
- persistence 1 · Aug 15
- command and control 1 · Jun 30
attack phases seen
- Persistence 2 · Aug 16
- Privilege escalation 1 · Aug 16
- Defense evasion 1 · Aug 15
- Command and control 1 · Jun 30
what we reported, newest first, grouped by story
Aug 15 – August 16, 2026 · 2 reports
- Mustang Panda's CoolClient goes kernel-mode — researchers discovered a rootkit variant of the CoolClient implant, using a kernel-mode driver, in victims across Pakistan, Mongolia, Myanmar, and Russia. @frdfzi via @cyb3rops
· Aug 16 · observed · Threat Activity
- HoneyMyte upgraded its CoolClient backdoor with a signed kernel-mode driver acting as a stealthy Windows rootkit for persistence, process hiding and C2 evasion, primarily against Asian targets (Securelist).
· Aug 15 · disclosed · as honeymyte · Threat Activity
June 30, 2026
- Mustang Panda is running two campaigns against Indian government and hydropower targets, abusing Zoho WorkDrive as a legitimate-cloud command channel, per Acronis. The Hacker News
· Jun 30 · observed · Threat Activity