The HoneyMyte advanced persistent threat (APT) group, also known as Mustang Panda, has significantly upgraded its CoolClient backdoor with a kernel-mode rootkit designed to conceal command-and-control (C2) infrastructure on compromised Windows systems.
The development represents a major evolution of the malware, which was previously associated primarily with user-mode espionage capabilities.
HoneyMyte has used CoolClient in campaigns targeting organizations across Asia and Russia, with recent activity observed in Myanmar, Mongolia, Pakistan, and Russia, including attacks against government entities.
HoneyMyte Upgrades CoolClient With Kernel Rootkit
CoolClient provides attackers with a broad collection of surveillance and remote-access capabilities. The backdoor can perform keylogging, clipboard theft, credential harvesting, file operations, system reconnaissance, and support additional functionality through a plugin-based architecture.
Researchers observed that HoneyMyte frequently uses PlugX as an initial implant following a successful compromise. PlugX can subsequently facilitate the deployment of CoolClient and other supporting components required to establish persistence and maintain access.
The infection chain also demonstrates an effort to disguise malicious components as legitimate Windows security software.
Before installing CoolClient, attackers reportedly create Microsoft Defender exclusions for a fake Windows Defender directory and a renamed executable called defender.exe. Malicious files are copied into a directory resembling the legitimate Microsoft Defender installation path, such as C:\Program Files\Microsoft\Windows Defender\.
The attackers additionally abuse a legitimate Sangfor application, typically Sang.exe, renaming it as defender.exe to perform DLL sideloading. When executed, the trusted application loads a malicious libngs.dll library.
CoolClient establishes persistence using both a scheduled task and an AutoRun registry entry named goopdate. The scheduled task can execute the fake Defender executable with SYSTEM privileges during startup, helping the malware survive system reboots while operating with elevated permissions.
The infection is divided into multiple components, allowing each stage to perform a specific function while making analysis and detection more difficult.
The legitimate Sangfor executable serves as the sideloading mechanism, while libngs.dll functions as an initial loader. It decrypts a second-stage payload called loadcert.ini directly in memory.
The second-stage component manages persistence, privilege checks, process injection, driver deployment, and loading of the final implant identified as cert.ini.
Researchers also observed injection into a process named synchost.exe, which resembles the legitimate Windows svchost.exe process and could potentially reduce the likelihood of casual detection.
CoolClient can additionally install itself as a Windows service named media_updaten. Before using this persistence method, the malware checks whether 360 Total Security endpoint software is running.
When administrator privileges are available, the malware may use an RPC-based User Account Control bypass combined with parent process ID spoofing.
This technique can make an elevated malicious process appear to have originated from a trusted Windows application.
The most significant development is the deployment of the signed msagent.sys kernel driver. CoolClient registers the driver as a service and loads it directly into the Windows kernel, allowing the malware to operate below many conventional user-mode security controls.
Communication between the backdoor and driver occurs through DeviceIoControl requests, or IOCTLs. Observed commands allow the malware to register its process as trusted, configure the C2 IPv4 address, and specify files and registry locations that the driver should protect or conceal.
The CoolClient upgrade demonstrates how sophisticated threat actors are combining DLL sideloading, persistence mechanisms, privilege escalation, process injection, and kernel-level capabilities to strengthen espionage operations.
Security teams should closely monitor suspicious Defender exclusions, abnormal scheduled tasks, unexpected services, DLL sideloading activity, unusual driver installations, and processes communicating through DeviceIoControl.
Endpoint teams should also investigate legitimate signed applications executing from unexpected paths, particularly when they load unfamiliar DLLs.
The move toward kernel-mode concealment highlights the growing importance of behavioral monitoring and driver-level visibility when defending Windows environments against advanced persistent threats.
No Comment! Be the first one.