Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyteaka Mustang Panda has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control C2 network information. Russian...

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group also known as Mustang Panda that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting,...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: terragrunt, trivy-fips, opentofu-fips, terraform-fips, opentofu, trivy-operator-fips, chainctl-fips, zarf-fips, wolfictl, cloudbeat, zot, grype-fips, k9s, terraform, task, cloudbeat-fips, cg, crossplane-provider-terraform-fips, trivy, xeol-fips, zarf, tflint-fips,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller-fips, flux-image-automation-controller, trivy-fips, flux-source-controller-fips, gitsign, pulumi-language-yaml, src-fingerprint, go-licenses, guac, flux-source-controller, argo-workflows, wolfictl, skaffold, crossplane,...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, trufflehog-fips, k8sgateway, kyverno-notation-aws-fips, cloud-provider-aws, kyverno-notation-aws, kube-metrics-adapter, dagdotdev, vault-env, kubevela, gcsfuse, dgraph, datadog-agent, witness, sftpgo-plugin-pubsub,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller-fips, flux-image-automation-controller, trivy-fips, flux-source-controller-fips, gitsign, pulumi-language-yaml, src-fingerprint, go-licenses, guac, flux-source-controller, argo-workflows, wolfictl, skaffold, crossplane,...

GO-2026-5764 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, yace-fips, aws-nuke, bento, trufflehog-fips, crossplane-provider-aws-route53-fips, trivy-operator-fips, crossplane-provider-aws-cognitoidentity-fips, chainloop-artifact-cas-fips, opencost-fips, vitess, crossplane-provider-aws-s3,...

GO-2025-4012 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: k8sgateway, kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, kyverno-policy-reporter-ui, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips,...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4014 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2025-4006 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips, skopeo-fips, flux,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cloud-provider-aws, whereabouts, kube-metrics-adapter, docker-credential-gcr, cert-exporter, gosu, dagdotdev, vault-env, kubevela, mattmoor-chainit, crossplane-function-environment-configs-fips, gcsfuse, crossplane-provider-terraform-fips,...

GO-2024-2610 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator-fips, flux-image-automation-controller, gh, nri-prometheus, k3s, paranoia, up, nri-elasticsearch, aws-load-balancer-controller-fips, yq, prometheus-operator-fips, trillian, wavefront-collector-for-kubernetes, docker-credential-gcr,...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator-fips, flux-image-automation-controller, gh, nri-prometheus, k3s, paranoia, up, nri-elasticsearch, aws-load-balancer-controller-fips, yq, prometheus-operator-fips, trillian, wavefront-collector-for-kubernetes, docker-credential-gcr,...

GO-2024-2600 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator-fips, flux-image-automation-controller, gh, nri-prometheus, k3s, paranoia, up, nri-elasticsearch, aws-load-balancer-controller-fips, yq, prometheus-operator-fips, trillian, wavefront-collector-for-kubernetes, docker-credential-gcr,...