MalwarePublished 29 Dec 2025

The HoneyMyte APT now protects malware with a kernel-mode rootkit

Source AlienVault OTX General

Description

In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated with the HoneyMyte APT group. The attacks, which began in February 2025, primarily target government organizations in Southeast and East Asia, especially Myanmar and Thailand. The malware uses various techniques to evade detection, including API obfuscation, process protection, and registry key protection. The ToneShell backdoor communicates with command-and-control servers using fake TLS headers and supports remote operations such as file transfer and shell access.

Impact

For European organizations, the direct impact is currently limited due to the geographic focus on Southeast and East Asia. However, the advanced kernel-mode rootkit and stealth techniques used by HoneyMyte demonstrate capabilities that could be adapted or expanded to other regions, including Europe. Government agencies, critical infrastructure, and organizations with strategic ties to Asia or involved in geopolitical matters may become targets. The rootkit’s ability to evade detection and maintain persistence at the kernel level could lead to prolonged unauthorized access, data exfiltration, espionage, and disruption of critical services. The use of compromised digital certificates undermines trust in software supply chains, potentially affecting European entities relying on similar certificates or software vendors. The stealthy communication using fake TLS headers complicates network detection, increasing the risk of unnoticed infiltration. Overall, the threat poses a medium risk to European organizations, particularly those in government, defense, or sectors with geopolitical relevance.

Defensive guidance

European organizations should implement advanced endpoint detection and response (EDR) solutions capable of detecting kernel-mode rootkits and anomalous driver behavior. Employ strict code signing policies and monitor for the use of compromised or unexpected digital certificates. Conduct regular integrity checks on critical system files, drivers, and registry keys to detect unauthorized modifications. Network monitoring should include deep packet inspection and anomaly detection to identify suspicious TLS traffic patterns, such as fake TLS headers used by ToneShell. Implement strict network segmentation and least privilege principles to limit lateral movement if a system is compromised. Maintain up-to-date threat intelligence feeds to recognize indicators of compromise related to HoneyMyte, including known file hashes and malicious domains. Conduct regular security awareness training focused on targeted phishing or social engineering tactics that may deliver such malware. Finally, establish incident response plans that include kernel-level malware removal procedures and forensic analysis capabilities.

Indicators of compromise

Domains 2

avocadomechanism.com
potherbreference.com

Hashes 3

36f121046192b7cac3e4bec491e8f1b5
abe44ad128f765c14d895ee1c8bad777
fe091e41ba6450bcf6a61a2023fe6c83

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Dec 2025, 22:19 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 2

Hashes 3

Community reviews

Related threats