Mustang Panda Deploys Signed Windows Rootkit to Enhance CoolClient Backdoor Stealth

Severity
Medium

Detail

The threat actor HoneyMyte, also known as Mustang Panda, has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit. The rootkit can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.

Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. CoolClient was consistently deployed as a secondary backdoor following a PlugX infection. The new CoolClient variant contains a previously undocumented kernel-mode driver that significantly expands the malware’s stealth capabilities.

How?

In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial post-compromise implant to deploy CoolClient. The attackers added Microsoft Defender exclusions for a fake Windows Defender installation directory and used a renamed legitimate Sangfor executable for DLL sideloading. The malware components were copied into the directory, while the executable was renamed defender.exe. Persistence was established through a scheduled task that launched the binary with SYSTEM privileges during system startup.

The legitimate Sangfor application then loads the malicious libngs.dll, which decrypts and executes loadcert.ini. This second-stage component handles persistence, registry modifications, UAC bypass, process injection, driver deployment and loading the final-stage cert.ini implant responsible for C2 communications and backdoor functionality.

loadcert.ini also creates an AutoRun registry entry named goopdate and can install a Windows service named media_updaten. It uses an RPC-based process creation technique with PPID spoofing to relaunch itself with elevated privileges before injecting into synchost.exe.

When the required privileges are available, loadcert.ini extracts an embedded LZMA-compressed driver, writes it as msagent.sys, and creates and starts a driver service named msagent. The driver is deployed when CoolClient has full access to the Service Control Manager (SCM) and SeTcbPrivilege. If these conditions are not met, the malware skips driver deployment and proceeds to the final-stage implant.

Impact

The msagent.sys driver provides kernel-level stealth capabilities. It can:

• Hide processes by unlinking them from the Windows active process list.
• Protect processes from actions such as termination and code injection.
• Hide protected files and directories using a filesystem minifilter.
• Remove protected registry keys and values from enumeration results.
• Block modification or deletion of protected registry objects.
• Filter configured C2 IPv4 addresses from network information returned to user mode.
• Hide processes and kernel modules.
• Manipulate registry values.

The driver receives configuration from CoolClient through IOCTL requests. Kaspersky identified 33 IOCTL handlers, although only three were observed during normal execution of the analyzed sample. CoolClient itself supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and additional functionality through plugins.

The driver is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd., which was valid from August 2013 to September 2014. Kaspersky identified older malicious drivers using the same certificate but found no evidence directly connecting those samples to the CoolClient activity.

Recommendation

Organizations should review the IoCs published by Kaspersky, including the associated file hashes, paths, and C2 domains, for evidence of CoolClient-related activity.

Particular attention should be given to the presence of:

• msagent.sys
• libngs.dll
• loadcert.ini
• cert.ini
• The media_updaten service
• The goopdate AutoRun registry entry
• The renamed defender.exe executable
• Suspicious DLL sideloading involving the Sangfor executable

Indicators of Compromise (IOCs)

Kaspersky published the following hashes:

• 2d7c8780e97409770a9d4f31c66c9d63 — msagent.sys
• 9460E150E1981D5C165043520c5c12fe — msagent.sys
• 9717f005c5fb98e08d2ad983d88f94ee — libngs.dll
• F518D8E5FE70D9090F6280C68A95998F — libngs.dll

Conclusion

HoneyMyte/Mustang Panda has enhanced the CoolClient backdoor with a signed Windows kernel-mode rootkit that substantially increases its stealth and persistence capabilities.

The infection chain observed in Myanmar begins with PlugX, followed by CoolClient components that establish persistence, perform UAC bypass and process injection, and deploy the msagent.sys kernel driver when the required privileges are available.

The rootkit uses 33 IOCTL handlers and multiple Windows callbacks to hide processes, files, registry objects, kernel modules, and C2 information, while protecting malicious components from termination and modification.

Kaspersky said the design of the new CoolClient driver is comparable to the kernel-mode enhancements previously observed with HoneyMyte’s ToneShell backdoor, although the CoolClient driver provides dedicated IOCTL handlers for direct communication with its user-mode backdoor.

Source

https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html
https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/