A Close Look under the DNS Hood of CoolClient

Securelist recently reported¹ a HoneyMyte (also known as “Mustang Panda” or “Bronze President”) campaign using an updated version of the CoolClient backdoor. Active in cyber-espionage operations, the group has previously deployed tools such as ToneShell, PlugX, Qreverse, Tonedisk, and SnakeDisk.

The 2025 CoolClient update introduces additional capabilities, including browser credential stealers and scripts for reconnaissance and data exfiltration.

Researchers initially identified four CoolClient network IoCs. After extracting domains from subdomains and filtering legitimate infrastructure, we analyzed six IoCs in total—three domains, two subdomains, and one IP address. Domain ownership checks using the WhoisXML API MCP Server² confirmed that none of the domains were associated with legitimate entities.

Our investigation of the CoolClient IoCs led to these findings:

• 57 email-connected domains
• One additional IP address that turned out to be malicious
• Five IP-connected domains, two of which have already been classified as malicious
• Three string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/
• [2] https://main.whoisxmlapi.com/ai/mcp-server