Precursor Intelligence

Threat News

Latest cyber threat intelligence, breaches and exploitation

1 matching story

Msagent.sys
  • Threat Actor Activity29 Aug 2026·2 sources

    HoneyMyte adds kernel-mode rootkit to CoolClient backdoor

    HoneyMyte (Mustang Panda) APT has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, Msagent.sys, that provides process hiding, file hiding, registry hiding, and network data filtering for deeper persistence and stealth in targeted intrusions across Asia and Russia.

    HoneyMyteMustang PandaCoolClient+3
    HoneyMyte adds kernel-mode rootkit to CoolClient backdoor