The Ghost in the Kernel: How HoneyMyte Weaponized a Rootkit to Hijack Asian Governments

Kaspersky Labs uncovered a mid-2025 HoneyMyte (Mustang Panda/Bronze President) campaign using a signed kernel-mode driver (ProjectConfiguration.sys) as a loader/bodyguard to deploy the ToneShell backdoor and harden persistence on government networks in Myanmar and Thailand; the rootkit manipulates driver altitude to disable Microsoft Defender components, communicates with C2 using fake TLS 1.3 headers (e.g., avocadomechanism.com), and ties to known HoneyMyte tools like PlugX and ToneDisk, indicating a sophisticated, stealthy, and ongoing espionage operation.