HoneyMyte - CoolClient Backdoor and Rootkit Driver Service Install

Georg Lauenstein@gsec

•updated Aug 16, 2026•4•1•27

Detects creation of a Windows service named "media_updaten" (the CoolClient backdoor persistence service, installed via CreateServiceA and started with 'sc start media_updaten') or "msagent" (the signed kernel-mode driver service that grants CoolClient its rootkit capabilities: process/file/registry hiding, object callback protection, and C2 IP filtering via Nsiproxy). Both exact service names are unique to this HoneyMyte campaign and are not associated with any legitimate Windows or third-party product.