CoolClient, a sophisticated backdoor family linked to the HoneyMyte APT group, has shown remarkable evolution since its initial disclosure in 2022. This malware has been actively utilized in cyber-espionage campaigns targeting organizations across Asia and Russia, showcasing capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance.
Following its first public analysis by Sophos, further investigations by Trend Micro in 2023 revealed enhancements to CoolClient, particularly a variant that introduced clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a significant transformation was noted: the latest variant can deploy a signed kernel-mode driver as a Windows service, enhancing its stealth and operational capabilities.
Technical Analysis
In a recent campaign targeting Myanmar, the HoneyMyte group employed PlugX as an initial implant to deploy CoolClient components. Prior to the deployment, the actors cleverly configured Microsoft Defender to exclude the fake Windows Defender installation directory and the renamed sideloader executable, defender.exe.
The actor created a counterfeit Windows Defender installation directory, transferring CoolClient components into it and renaming a legitimate Sangfor executable to defender.exe to facilitate DLL sideloading. This method involved using commands to exclude paths from Microsoft Defender’s scrutiny, ensuring that the malicious activities remained undetected.
Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at system startup. Upon execution, defender.exe sideloads the malicious libngs.dll, initiating the CoolClient execution chain.
CoolClient Components
The latest CoolClient variant maintains a multi-stage execution chain, with each component serving a specific role:
- defender.exe / Sang.exe: A legitimate application exploited for DLL sideloading.
- libsrapc.dll: A benign dependency necessary for the Sangfor application.
- libngs.dll: The first-stage loader that decrypts and loads the next stage into memory.
- loadcert.ini: The second-stage DLL implementing core CoolClient functionalities, including command handling and persistence.
- cert.ini: The final-stage implant responsible for command and control communication.
- time.ini: The configuration file for CoolClient.
The execution begins with the legitimate Sangfor application loading libngs.dll through DLL sideloading. This DLL, designed to appear legitimate, exports numerous dummy functions that serve no purpose other than to mimic expected behavior. The actual malicious logic is executed from DllMain, where it loads, decrypts, and executes the second-stage DLL, loadcert.ini.
First Stage: libngs.dll
The first stage initiates when the sideloaded libngs.dll is executed. It employs obfuscation techniques to conceal its operations while performing the critical task of loading and executing the next stage, loadcert.ini.
Second Stage: loadcert.ini (Injected Execution)
Upon being injected into synchost.exe, loadcert.ini prepares the execution environment. It checks its context and, if running under the original sideloaded process, performs initial setup tasks including persistence and process injection. If already executing within synchost.exe, it deploys the kernel-mode driver and loads the final-stage implant.
Kernel-Mode Driver Deployment
The deployment routine for the kernel-mode driver begins by decrypting time.ini. The malware verifies its privileges to install the driver, extracts an embedded driver, and writes it to disk. It then creates a service to execute the driver, enhancing the malware’s stealth capabilities significantly.
Msagent.sys Driver
The deployed kernel-mode driver, msagent.sys, is digitally signed and contains references to its development environment. This driver enhances CoolClient’s stealth by enabling it to hide processes, files, and registry objects, making detection increasingly challenging.
Victimology
The latest variant of CoolClient continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor following a PlugX infection indicates a strategic approach by HoneyMyte to maintain access to compromised systems.
Attribution
Our analysis confirms that the investigated malware is a new variant of CoolClient associated with the HoneyMyte threat group. The introduction of a kernel-mode driver marks a significant advancement in its operational capabilities, reinforcing the attribution to this well-documented group.
