← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
IOC - HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns
WHITE HoneyMyte celestre 2026-01-28 Modified: 2026-02-26
19
IOCs
MEDIUM VOLUME
data theftplugxsoutheast asiatoneshellbackdoorcredential stealingluminousmothaptcoolclientqreversegovernment
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
CoolClient ToneShell PlugX - S0013 Thoper TVT DestroyRAT Sogu Kaba Korplug LuminousMoth QReverse
Indicators of Compromise (13 / 19 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 1a5a9c013ce1b65abc75d809a25d36a7 — 2026-01-28
FileHash-MD5 1a61564841bbbb8e7774cbbeb3c68d5d — 2026-01-28
FileHash-MD5 1bc5329969e6bf8ef2e9e49aab003f0b — 2026-01-28
FileHash-MD5 6b7300a8b3f4aac40eeecfd7bc47ee7c — 2026-01-28
FileHash-MD5 7aa53ba3e3f8b0453ffcfba06347ab34 — 2026-01-28
FileHash-MD5 838b591722512368f81298c313e37412 — 2026-01-28
FileHash-MD5 a1cd59f769e9e5f6a040429847ca6eae — 2026-01-28
FileHash-MD5 a4d7147f0b1ca737bfc133349841aaba — 2026-01-28
FileHash-MD5 aeb25c9a286ee4c25ca55b72a42efa2c — 2026-01-28
FileHash-MD5 c19bd9e6f649df1df385deef94e0e8c4 — 2026-01-28
FileHash-MD5 da6f89f15094fd3f74ba186954be6b05 — 2026-01-28
FileHash-MD5 e1b7ef0f3ac0a0a64f86e220f362b149 — 2026-01-28
FileHash-MD5 f518d8e5fe70d9090f6280c68a95998f — 2026-01-28
References (1)
↗ https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/