The threat actor known as HoneyMyte, also referred to as Mustang Panda, has recently been observed deploying an upgraded version of the CoolClient backdoor. This latest iteration includes a signed Windows kernel-mode rootkit, which enhances its ability to conceal and safeguard malicious processes, files, registry objects, and command-and-control (C2) network information.
According to Russian cybersecurity vendor Kaspersky, victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is typically deployed as a secondary layer of access following an initial PlugX infection.
The kernel component is activated when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are unmet, the malware bypasses driver deployment and advances directly to the final-stage implant.
Kaspersky has made available file hashes, paths, and C2 domains as indicators of compromise (IoCs), further detailing their findings.
“Our analysis confirms that the investigated malware is a new CoolClient variant associated with the HoneyMyte threat group. While the overall execution flow remains consistent with previously documented CoolClient variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware’s stealth capabilities,” Kaspersky noted.
CoolClient’s Functionality and Deployment
In a recent campaign targeting Myanmar, Kaspersky reported that HoneyMyte utilized PlugX as the initial post-compromise implant to deploy CoolClient. This involved adding Microsoft Defender exclusions for a fabricated Windows Defender installation directory and a renamed sideloading executable.
The actor strategically copied malware components into the designated directory, renaming a legitimate Sangfor executable to defender.exe for DLL sideloading. Persistence was established through a scheduled task that executed the binary with SYSTEM privileges at system startup.
Execution initiates when the legitimate Sangfor application loads a malicious libngs.dll, which decrypts and executes the second-stage component loadcert.ini. This component manages persistence, registry modifications, User Account Control (UAC) bypass, process injection, driver deployment, and the loading of the final-stage cert.ini implant responsible for C2 communications and backdoor functionality.
The second-stage malware creates an AutoRun registry entry named goopdate and can also install a Windows service called media_updaten. It employs a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing, allowing it to relaunch itself in an elevated context before injecting into a process named synchost.exe.
Kernel-Level Stealth Enhancements
When the necessary privileges are granted, loadcert.ini extracts an embedded LZMA-compressed kernel driver, writes it to disk as msagent.sys, and establishes a driver service named msagent.
Kaspersky revealed that the driver is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd., valid from August 2013 to September 2014. The security firm identified several older malicious drivers signed with the same certificate, although no direct connection to the CoolClient activity was established.
Once loaded, the driver receives configuration data from the CoolClient user-mode component via IOCTL requests. The analyzed sample utilized three specific requests during normal execution:
- 0x222120: Registers the current CoolClient process as a trusted process with the driver.
- 0x2221E0: Passes the configured C2 IPv4 address to the driver.
- 0x2220F0: Registers filesystem and registry paths that should be protected.
The first request allows the registered CoolClient process to access protected files, registry keys, and processes, while the third registers its installation directory and service registry path, ensuring these objects are shielded from inspection, modification, and deletion.
The rootkit retrieves its stealth configuration from REGISTRYMACHINESYSTEMRNG and utilizes distinct configuration entries for directories, files, registry keys and values, and processes that require hiding, protection, or exclusion.
For process protection, the driver can limit the access rights granted when another process attempts to open a handle to a protected process, effectively preventing operations such as termination and code injection. In the analyzed sample, Kaspersky indicated that the protected process contained CoolClient code injected into synchost.exe.
The driver further implements process hiding by unlinking entries from the Windows active process list, employs a filesystem minifilter to deny access to protected files and directories, and registers a registry callback that removes protected keys and values from enumeration results, blocking any attempts to modify or delete them.
A separate hook installed in the Windows Nsiproxy driver filters configured C2 IPv4 addresses from network information returned to user mode.
Kaspersky discovered that msagent.sys incorporates 33 IOCTL handlers, which include functionalities for hiding processes and kernel modules, manipulating registry values, and interacting with kernel notification callbacks. However, the analyzed CoolClient sample invoked only the three IOCTLs mentioned earlier during standard execution, with the remaining handlers not observed in use.
Among the indicators shared by Kaspersky are the following hashes:
- 2d7c8780e97409770a9d4f31c66c9d63 – msagent.sys
- 9460E150E1981D5C165043520c5c12fe – msagent.sys
- 9717f005c5fb98e08d2ad983d88f94ee – libngs.dll
- F518D8E5FE70D9090F6280C68A95998F – libngs.dll
This development follows Kaspersky’s earlier disclosure, over six months ago, regarding a newer CoolClient variant utilized in a campaign targeting Pakistan and Myanmar, which dropped and executed a previously unseen rootkit. Additionally, Kaspersky had documented a different HoneyMyte kernel-mode rootkit in December 2025, which was employed to load the ToneShell backdoor. The company noted that the overall design of the new CoolClient driver is comparable to the kernel-mode enhancements observed with ToneShell, while the CoolClient component features dedicated IOCTL handlers for direct communication with the user-mode backdoor.
