[Stanley]

Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks

Threat actors with ties to China have been observed using an updated version of a backdoor called COOLCLIENT in cyber espionage attacks in 2025 to facilitate comprehensive data theft from infected endpoints.
The activity has been attributed to Mustang Panda (aka Earth Preta, Fireant, HoneyMyte, Polaris, and Twill Typhoon) with the intrusions primarily directed against government entities located

https://thehackernews.com/2026/01/mustan...dated.html

[The Pact]

These attacks primarily targeted government entities in Myanmar, Mongolia, Malaysia, and Russia, reflecting the group’s continued evolution toward deeper surveillance and more sophisticated data‑exfiltration campaigns.