Chinese Hackers Deploy Rootkit to Conceal ToneShell Malware in Southeast Asia
Article Content
Browse articles 
A Chinese-linked threat group, associated with HoneyMyte, is utilizing a new kernel rootkit to obscure its ToneShell backdoor. This cyber campaign has primarily targeted government networks in Southeast and East Asia, with significant effects noted in Myanmar and Thailand, focusing on long-term espionage rather than immediate financial gain.
Ask AI about this cluster
Answers cite the sources they use
Updated 182d ago How this analysis works
More articles in this cluster (3)
Following this threat?
Track Bronze President and ToneShell in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
HoneyMyte APT Upgrades CoolClient Backdoor with Kernel Driver for Enhanced Stealth The HoneyMyte APT group has deployed an upgraded variant of the CoolClient backdoor in cyber-espionage campaigns targeting organizations in Myanmar, Mongolia, Pakistan, India, and Russia. This new variant introduces a signed kernel-mode driver that enhances the malware's stealth, allowing it to hide processes and… 
Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…