HoneyMyte Threat Group Enhances Cyber Espionage Arsenal with Advanced Malware The HoneyMyte threat group also tracked as Mustang Panda or Bronze President has intensified its cyber espionage campaigns, targeting government organizations across Asia and Europe with upgraded malware tools. Recent research reveals the group’s focus on Southeast Asia, where it has refined its tactics to extract sensitive data from compromised systems. In 2025, security analysts identified significant enhancements to CoolClient, HoneyMyte’s primary backdoor malware. The group has expanded its toolset with new variants of the malware, leveraging DLL sideloading a technique that abuses legitimate software (including BitDefender, VLC Media Player, and Sangfor) to execute malicious payloads. Campaigns have been detected in Myanmar, Mongolia, Malaysia, Russia, and Pakistan, with government agencies as the primary targets. Beyond CoolClient, HoneyMyte has deployed specialized browser credential stealers to harvest login data from popular browsers. Three variants have been observed: - Variant A: Targets Google Chrome - Variant B: Focuses on Microsoft Edge - Variant C: Supports Chromium-based browsers (Brave, Opera) The malware extracts encrypted credentials by copying browser databases, decrypting them using Windows Data Protection API, and exfiltrating the data to attacker-controlled servers. Additional capabilities, such as keylogging and clipboard monitoring, suggest a shift toward active surveillance beyond traditional espionage. HoneyMyte’s evolving tactics underscore its persistence in refining tools for data theft and system compromise, posing a continued threat to high-value targets in the region.