The HoneyMyte APT now protects malware with a kernel-mode rootkit
In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated with the HoneyMyte APT group. The attacks, which began in February 2025, primarily target government organizations in Southeast and East Asia, especially Myanmar and Thailand. The malware uses various techniques to evade detection, including API obfuscation, process protection, and registry key protection. The ToneShell backdoor communicates with command-and-control servers using fake TLS headers and supports remote operations such as file transfer and shell access.
Pulse ID: 69528092ee9eed9c6d16d25d
Pulse Link: https://otx.alienvault.com/pulse/69528092ee9eed9c6d16d25d
Pulse Author: AlienVault
Created: 2025-12-29 13:22:26
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Asia #BackDoor #CyberSecurity #Government #InfoSec #Malware #Myanmar #OTX #OpenThreatExchange #RAT #Rootkit #TLS #Thailand #Trojan #bot #AlienVault
![Example of initial URL from sites.google[.]com.](https://files.mastodon.social/cache/media_attachments/files/115/805/248/319/213/212/original/a269fb9f29e1651b.jpg)
