Mustang Panda, also known as HoneyMyte, has upgraded its CoolClient backdoor with a signed kernel-mode driver, significantly enhancing its stealth and persistence on compromised Windows systems. This new variant, documented by Kaspersky, has been observed in attacks targeting entities in Pakistan, Mongolia, Myanmar, and Russia, including confirmed government organizations.
CoolClient, first identified in 2022 by Sophos and further analyzed by Trend Micro in 2023, has steadily evolved. In 2025, Kaspersky noted the addition of clipboard theft and HTTP traffic interception for credential harvesting. The latest iteration integrates a kernel rootkit, allowing the malware to hide its processes, files, and network activity, making it substantially more difficult to detect and remove.
The kernel-mode driver is deployed as a Windows service and communicates with the user-mode backdoor via IOCTL requests. This design is reminiscent of kernel-mode enhancements previously seen in ToneShell, but the CoolClient driver features dedicated IOCTL handlers for direct interaction with the user-mode component.
Attackers initiate the compromise by first deploying PlugX as a post-compromise implant, followed by CoolClient. Before launching CoolClient, the threat actor adds exclusions to Microsoft Defender for a fabricated Windows Defender directory and the executable used for DLL sideloading. This involves creating a fake `Microsoft\Windows Defender` installation directory, copying CoolClient components there, and renaming a legitimate Sangfor executable, `Sang.exe`, to `defender.exe`. This trusted executable then sideloads the malicious `libngs.dll`.
Persistence is established early through a scheduled task that launches `defender.exe` with SYSTEM privileges at startup. CoolClient can also create an AutoRun entry or install itself as a Windows service, with a check for security software like 360 Total Security processes preceding the service installation route.
The user-mode execution chain involves several stages: `libngs.dll` acts as the first-stage loader, `loadcert.ini` handles the second stage, `cert.ini` provides the final backdoor, and `time.ini` stores configuration data. `libngs.dll` attempts to mimic a legitimate DLL by exporting dummy functions that call `OutputDebugStringA` before terminating, with the actual malicious code residing in `DllMain`. The loader decrypts and loads `loadcert.ini` directly into memory.
CoolClient prepares the system by establishing persistence, bypassing User Account Control (UAC), and injecting its payload into `synchost.exe`. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without triggering a visible administrator prompt. Once privileged, it extracts the compressed `msagent.sys` driver, installs it as a Windows service, and loads it into the kernel.
Through IOCTL requests, CoolClient registers itself as a trusted process, provides its command-and-control (C2) address, and defines the files, registry keys, and processes to be protected. The driver then prevents security tools from accessing or terminating these protected components. The driver's configuration is read from `\REGISTRY\MACHINE\SYSTEM\RNG`, specifying directories, files, registry keys, and values to hide or protect, as well as processes to ignore or protect.
For kernel module hiding, the driver dynamically resolves the address of the non-exported kernel variable `PsLoadedModuleList` at runtime using `MmGetSystemRoutineAddress`. This global linked list, which maintains information about all loaded kernel modules and drivers, allows the rootkit to enumerate and manipulate module entries. For process hiding, the driver dynamically locates `ActiveProcessLinks` within the Windows `EPROCESS` structure, avoiding reliance on fixed offsets that can change between Windows versions. Once located, the rootkit can unlink a process from the active process list and later restore it.
The driver also registers object, process, and image-load callbacks. These mechanisms enable it to track processes and restrict access to protected ones, including the CoolClient code running within `synchost.exe`. Any attempt to open a protected process or thread can result in reduced access rights, blocking operations such as termination or code injection. File protection is achieved through a Windows filesystem minifilter, where the driver maintains lists of protected paths and denies access to matching files and directories. Similarly, registry protection ensures that protected keys and values are hidden from enumeration and direct attempts to open, modify, or delete them return `STATUS_ACCESS_DENIED`.
