The Ghost in the Kernel: How HoneyMyte Weaponized a Rootkit to Hijack Asian Governments

According to Kaspersky Labs, the HoneyMyte threat actor has upgraded its toolkit with a kernel-mode rootkit to entrench itself in government networks across Southeast and East Asia, with a campaign discovered in mid-2025 and suspected to have begun in February 2025. The operation targets organisations in Myanmar and Thailand, often re-infecting victims who previously faced the group’s older tools.

Central to the campaign is a malicious driver named ProjectConfiguration.sys, which bypasses security checks by being signed with a legitimate but likely stolen certificate issued to Guangzhou Kingteller Technology Co., Ltd.—a certificate that had expired in 2015. Once installed, the driver serves as a bodyguard for the malware, registering as a mini-filter driver and enabling the backdoor Trojan to operate while protecting malicious files, user-mode processes, and registry keys.

The attackers manipulate the altitude of system drivers to blunt security software, and even tamper with Microsoft Defender to prevent its loading into the I/O stack. The operators now deploy ToneShell via a kernel-mode loader to evade user-mode monitoring and blend traffic with legitimate network activity, communicating with C2 servers such as avocadomechanism[.]com using fake TLS 1.3 headers, with high confidence that the activity is linked to HoneyMyte, according to the report.