The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

The HoneyMyte APT campaign, identified in mid-2025, employed a kernel-mode rootkit to deliver and shield a ToneShell backdoor on infected machines in Asia. The malicious driver, registered as ProjectConfiguration.sys, uses a mini-filter driver and injects a ToneShell payload via a newly created svchost process, with the ToneShell backdoor itself connecting to two C2 domains over port 443 using fake TLS headers.

The driver is signed with a digital certificate from Guangzhou Kingteller Technology Co., Ltd., with a serial number 08 01 CC 11 EB 4D 1D 33 1E 3D 54 0C 55 A4 9F 7F, a certificate that reportedly dated from 2012 to 2015. ToneShell checks for a marker inside C:\ProgramData\MicrosoftOneDrive[.]tlb to derive a four‑byte host identifier and uses two C2 domains, avocadomechanism[.]com and potherbreference[.]com, for its communications.

The campaign shows the malware protecting itself by blocking attempts to remove or rename the driver, safeguarding registry keys and user‑mode processes, and injecting payloads directly into high‑privilege targets. According to Securelist, the activity is linked to the HoneyMyte threat group, with kernel‑mode injectors representing a notable evolution in their 2025 operations.