Securelist

HoneyMyte APT Group Targets Government Entities with Updated Stealers

First seen 27 Jan 2026, 12:04 UTC • Securelist

•73% similarity •36.2

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

HoneyMyte, also known as Mustang Panda or Bronze President, has been active in espionage campaigns targeting government entities in Asia and Europe, particularly Southeast Asia. The group has deployed multiple sophisticated tools, including the CoolClient backdoor and various USB worms, to facilitate their operations.

ThreatCluster AI How this analysis works

Attack Flow

21 entities, 43 inferred relationships (STIX 2.1).

Threat Actor (1)

HoneyMyte

Technique (6)

Data Breach
Malware
T1056.001 - Keylogging
T1115 - Clipboard Data
T1218 - Signed Binary Proxy Execution
T1574 - Hijacking Execution Flow (DLL Side-Loading)

Campaign (2)

HoneyMyte Campaigns
ToneShell Campaign

Indicator (8)

pixeldrain.com
1A5A9C013CE1B65ABC75D809A25D36A7
1A61564841BBBB8E7774CBBEB3C68D5D
1BC5329969E6BF8EF2E9E49AAB003F0B
6B7300A8B3F4AAC40EEECFD7BC47EE7C
7AA53BA3E3F8B0453FFCFBA06347AB34
838B591722512368F81298C313E37412
A1CD59F769E9E5F6A040429847CA6EAE

Malware (4)

CoolClient
LuminousMoth
PlugX
ToneShell

Relationships

HoneyMyte uses CoolClient
HoneyMyte uses LuminousMoth
HoneyMyte uses PlugX
HoneyMyte uses ToneShell
HoneyMyte uses Data Breach
HoneyMyte uses Malware
HoneyMyte uses T1056.001 - Keylogging
HoneyMyte uses T1115 - Clipboard Data
HoneyMyte uses T1218 - Signed Binary Proxy Execution
CoolClient communicates with pixeldrain.com
CoolClient communicates with 1A5A9C013CE1B65ABC75D809A25D36A7
CoolClient communicates with 1A61564841BBBB8E7774CBBEB3C68D5D
CoolClient communicates with 1BC5329969E6BF8EF2E9E49AAB003F0B
CoolClient communicates with 6B7300A8B3F4AAC40EEECFD7BC47EE7C
LuminousMoth communicates with pixeldrain.com
LuminousMoth communicates with 1A5A9C013CE1B65ABC75D809A25D36A7
LuminousMoth communicates with 1A61564841BBBB8E7774CBBEB3C68D5D
LuminousMoth communicates with 1BC5329969E6BF8EF2E9E49AAB003F0B
LuminousMoth communicates with 6B7300A8B3F4AAC40EEECFD7BC47EE7C
PlugX communicates with pixeldrain.com
PlugX communicates with 1A5A9C013CE1B65ABC75D809A25D36A7
PlugX communicates with 1A61564841BBBB8E7774CBBEB3C68D5D
PlugX communicates with 1BC5329969E6BF8EF2E9E49AAB003F0B
PlugX communicates with 6B7300A8B3F4AAC40EEECFD7BC47EE7C
ToneShell communicates with pixeldrain.com
ToneShell communicates with 1A5A9C013CE1B65ABC75D809A25D36A7
ToneShell communicates with 1A61564841BBBB8E7774CBBEB3C68D5D
ToneShell communicates with 1BC5329969E6BF8EF2E9E49AAB003F0B
ToneShell communicates with 6B7300A8B3F4AAC40EEECFD7BC47EE7C
HoneyMyte Campaigns attributed to HoneyMyte
ToneShell Campaign attributed to HoneyMyte
HoneyMyte Campaigns uses CoolClient
HoneyMyte Campaigns uses LuminousMoth
HoneyMyte Campaigns uses PlugX
HoneyMyte Campaigns uses ToneShell
ToneShell Campaign uses CoolClient
ToneShell Campaign uses LuminousMoth
ToneShell Campaign uses PlugX
ToneShell Campaign uses ToneShell
HoneyMyte related to 7AA53BA3E3F8B0453FFCFBA06347AB34
HoneyMyte related to 838B591722512368F81298C313E37412
HoneyMyte related to A1CD59F769E9E5F6A040429847CA6EAE
HoneyMyte related to T1574 - Hijacking Execution Flow (DLL Side-Loading)

Community

Browse all →

Tracked Entities in This Story

HoneyMyte CoolClient LuminousMoth PlugX ToneShell HoneyMyte Campaigns ToneShell Campaign Government

HoneyMyte APT Group Targets Government Entities with Updated Stealers

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story