A sophisticated backdoor known as CoolClient, attributed to the HoneyMyte APT group (also referred to as Mustang Panda), has undergone a significant evolution, now incorporating a signed kernel-mode driver to enhance its stealth capabilities. This updated variant has been observed in cyber-espionage campaigns targeting organizations across Asia, specifically in Pakistan, Mongolia, and Myanmar, as well as Russia.
CoolClient, which has been under observation since its initial public disclosure in 2022 and subsequent analyses in 2023 and 2025, traditionally offers capabilities such as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. The latest iteration, identified in late 2025 and 2026, introduces a kernel-mode driver that operates as a Windows service, communicating with the user-mode backdoor via IOCTL requests. This driver is designed to hide the CoolClient process, protect associated files and registry entries, and prevent their inspection or modification, thereby making the malware more difficult to detect and analyze. This design parallels kernel-mode enhancements previously seen in the ToneShell malware.
In a specific campaign targeting Myanmar, the HoneyMyte group utilized PlugX as an initial post-compromise implant to deploy the CoolClient components. Prior to deployment, the attackers configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed sideloader executable, `defender.exe`, from scanning. This was achieved using `wmic` commands to add exclusion paths for both the directory and the executable.
The attackers then created a directory named `Microsoft\Windows Defender` within the `$programfiles` path, copying CoolClient components into it. A legitimate Sangfor executable, typically `Sang.exe`, was renamed to `defender.exe` to serve as a DLL sideloader. Persistence was established by creating a scheduled task that launches `defender.exe` with SYSTEM privileges during system startup, named `\Microsoft\Windows\Windows Defender Advanced Threat Protection Service`.
Upon execution, `defender.exe` sideloads `libngs.dll`, initiating the multi-stage CoolClient execution chain. The components involved include the legitimate Sangfor application (`defender.exe` or `Sang.exe`) for DLL sideloading, `libsrapc.dll` (a benign dependency), `libngs.dll` (the first-stage loader), `loadcert.ini` (the second-stage DLL with core CoolClient functionality), `cert.ini` (the final-stage implant for C2 communication), and `time.ini` (the configuration file). Notably, `loader.dat` and `main.dat` from previous variants have been renamed to `loadcert.ini` and `cert.ini`, respectively.
The first-stage loader, `libngs.dll`, is loaded via DLL sideloading. It contains numerous dummy export functions that call `OutputDebugStringA` and `ExitProcess` to mimic a legitimate DLL. The actual malicious logic resides in `DllMain`, which, despite heavy obfuscation, decrypts and loads the second-stage DLL, `loadcert.ini`, into memory. Decryption uses a 0x32-byte repeating XOR keystream derived from a seed value of 0xA4.
The second-stage DLL, `loadcert.ini`, first determines its execution context. If running under the original sideloaded process (e.g., `Sang.exe`), it performs initial setup, including persistence, a UAC bypass, registry modifications, and process injection. If already executing within `synchost.exe`, it decrypts `time.ini`, deploys the kernel-mode driver, and loads the final-stage implant, `cert.ini`.
