HoneyMyte (CoolClient) Script-Based Exfiltration

Kaung Khant Ko@kaungkhantko

•updated Jan 28, 2026•40•2•237

Detects the execution of rar.exe to create a password-protected archive with a known password, or the use of curl.exe to exfiltrate data to known HoneyMyte infrastructure. This TTP is associated with the group's script-based data collection and exfiltration activities.