Researchers Trace DNS and WHOIS Artifacts Linked to HoneyMyte’s CoolClient
Summary
Researchers report HoneyMyte updated CoolClient in 2025 to deploy browser-login stealers and data-theft and reconnaissance scripts. DNS and WHOIS analysis refined its reported IoCs and found related domains and IPs; some flagged entities may be reclassified.
Key points
- Researchers report that HoneyMyte, also known as Mustang Panda or Bronze President, updated the CoolClient backdoor in 2025 to deploy browser login stealers and data-theft and reconnaissance scripts.
- The researchers refined the initial four network IoCs to six: three domains, two subdomains and one IP address. They report that the three domains were not owned by legitimate entities.
- WHOIS-history and reverse-WHOIS analysis identified 57 email-connected domains after filtering out domains already classified as IoCs.
- DNS and IP lookups identified an additional IP that researchers say was associated with malware distribution on 14–15 February 2026; it was geolocated in Japan.
- The researchers flagged japan[.]lenovoappstore[.]com as suspicious because it uses Lenovo’s name, is not owned by Lenovo and has no live website; they did not establish that it was used for phishing.
- The article cautions that some entities flagged as malicious or suspicious may be reclassified after further investigation.
Article Details
- Event Type
- Reported HoneyMyte campaign using an updated CoolClient backdoor.
- Impact
- The updated backdoor reportedly deploys browser login-data stealers and data-theft and reconnaissance scripts. The article does not identify affected victims or quantify any resulting impact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | lenovoappstore[.]com | Identified by the researchers as a CoolClient network IoC; they reported that it was not owned by a legitimate entity. The article notes that some flagged entities may be reclassified after further investigation. |
| HOSTNAME | japan[.]lenovoappstore[.]com | Flagged as a suspicious CoolClient subdomain IoC. The researchers said it uses the Lenovo name, does not belong to Lenovo, and may be associated with phishing or other malicious activity; they did not confirm such activity. |
Threat Actors
Bronze PresidentThe article identifies Bronze President as another name for HoneyMyte, the group it attributes the CoolClient campaign to.HoneyMyteThe article attributes the campaign using the updated CoolClient backdoor to HoneyMyte.Mustang PandaThe article identifies Mustang Panda as another name for HoneyMyte, the group it attributes the CoolClient campaign to.
Malware
Tools
PlugXThe group has been known to use various sophisticated tools like ToneShell, PlugX, Qreverse, CoolClient, Tonedisk, and SnakeDisk, among others.QreverseThe group has been known to use various sophisticated tools like ToneShell, PlugX, Qreverse, CoolClient, Tonedisk, and SnakeDisk, among others.SnakeDiskThe group has been known to use various sophisticated tools like ToneShell, PlugX, Qreverse, CoolClient, Tonedisk, and SnakeDisk, among others.TonediskThe group has been known to use various sophisticated tools like ToneShell, PlugX, Qreverse, CoolClient, Tonedisk, and SnakeDisk, among others.ToneShellThe group has been known to use various sophisticated tools like ToneShell, PlugX, Qreverse, CoolClient, Tonedisk, and SnakeDisk, among others.
Countries
JapanThe subdomain japan[.]lenovoappstore[.]com impersonates a major brand (Lenovo), lacks a legitimate owner and a live site, and was flagged as suspicious for potential phishing or malicious use.MalaysiaTwo IPs were identified for further investigation: one geolocated in Malaysia (Extreme Broadband) and an additional malicious IP geolocated in Japan (NTT/OCN) with malware distribution activity observed on 14–15