Do Son 
Overview of the new variant of CoolClient | Image: Kaspersky Labs
At a Glance
- Actor or Group: HoneyMyte (also known as Mustang Panda)
- Activity Type: Cyber-espionage and rootkit deployment
- Targets or Victims: Government entities and organizations in Asia and Russia
- Scale: Multiple intrusions across Myanmar, Mongolia, Pakistan, and Russia
- Jurisdiction Status: Unindicted suspected state-sponsored threat group
- Source: Kaspersky Labs, with previous tracking by Sophos and Trend Micro
TL;DR
Security researchers discovered an updated variant of the HoneyMyte CoolClient rootkit targeting Asian and Russian entities. The backdoor now installs a signed kernel-mode driver to hide malicious processes and network traffic. Consequently, this driver prevents administrators from detecting the espionage implant.
What Happened
Kaspersky recently published technical details on a major upgrade to the CoolClient backdoor. In recent intrusions, attackers deployed the HoneyMyte CoolClient rootkit as a secondary payload following an initial PlugX infection. Furthermore, the operators abused a legitimate Sangfor binary to sideload malicious dynamic link libraries.
First, the attackers added exclusions to Windows Defender settings. Next, they placed a renamed Sangfor binary into a fake Defender folder. This executable sideloaded a malicious loader named libngs.dll during startup. Subsequently, the loader decrypted the second-stage component and injected it into a suspended synchost.exe process.
Kernel-Mode Driver Deployment
Once inside synchost.exe, the malware extracts an embedded kernel-mode driver named msagent.sys. The backdoor verifies administrative permissions and starts the driver as a system service. Additionally, the driver uses a digital certificate originally issued to Nanjing Ranyi Technology Co., Ltd.
The driver uses dedicated input-output control codes to interact directly with the user-mode backdoor. According to Kaspersky, “The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.”
Rootkit Evasion Techniques
The rootkit modifies internal Windows kernel structures directly. Specifically, it dynamically locates the active process links within the EPROCESS structure. It unlinks the malware process to hide it from process viewers. Moreover, the driver registers filesystem minifilters and registry callbacks to block access to malicious files.
In addition, the driver hooks the Nsiproxy driver. This hook filters network traffic lists returned to user mode. Therefore, administrative tools cannot display the active command-and-control IP addresses. As Kaspersky noted, “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.”
Who Is Behind It
Threat intelligence analysts attribute this campaign to HoneyMyte with high confidence. The group also operates under aliases such as Mustang Panda, Bronze President, and Earth Preta. Historically, the cyber-espionage group focuses on gathering intelligence across Asian government bodies. Earlier reports from Sophos in 2022 and Trend Micro in 2023 also tracked this group.
Furthermore, HoneyMyte previously used similar kernel-mode techniques in their ToneShell malware family. The shared tactics, techniques, and infrastructure strongly support this attribution. However, law enforcement agencies have not yet issued formal indictments against specific operators.
Impact and Scale
The observed intrusions targeted critical organizations across multiple countries. Confirmed victims include government entities in Myanmar, Mongolia, Pakistan, and Russia. HoneyMyte deployed this implant to maintain long-term surveillance on infected networks. The malware steals keystrokes, harvests credentials, and exfiltrates sensitive files.
While total financial losses remain unstated, the espionage impact is significant. The rootkit allows attackers to operate undetected for extended periods. Consequently, compromised organizations risk losing confidential policy documents and administrative credentials.
What Comes Next and Defense Guidance
Security teams should implement proactive detection strategies to identify this malware family. Organizations must monitor for abnormal Windows Defender exclusion modifications.
Additionally, defenders should inspect unlinked kernel modules and verify digital certificates on all installed drivers. Blocking known HoneyMyte infrastructure at the network perimeter also reduces exposure. Finally, enable kernel protection features such as Driver Signature Enforcement to stop unauthorized rootkit drivers.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
