KasperskyPublished
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
By Noushin Shabab
Excerpt
Overview of the attacks
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor Trojan into the system processes and provide protection for malicious files, user-mode processes, and registry keys.
Our analysis indicates that the final payload injected by the driver is a new sample of the ToneShell backdoor, which connects to the attacker’s servers and provides a reverse shell, along with other capabilities. The ToneShell backdoor is…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Kaspersky on securelist.com.
More from Kaspersky7
- Mirage Kitten targets Middle East and Africa region with new malwareKaspersky · Published 28 Jul
- Armored Likho's new weapon: BusySnake StealerKaspersky · Published 3 Jul
- Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devicesKaspersky · Published 17 Feb
- Securelist | Kaspersky’s threat research and reportsKaspersky · Published 16 Apr
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
