HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that can conceal malware artifacts and command-and-control infrastructure from security tools.
The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection tools operate.
Earlier versions supported reconnaissance, file operations, keylogging, clipboard theft, credential collection, and a plugin-based extension framework.
A 2025 update also added browser-focused credential theft and HTTP traffic interception, showing that the malware family was already expanding beyond conventional remote-access capabilities.
The newly analyzed variant deploys a kernel driver named msagent.sys, installed as a Windows service after CoolClient obtains sufficient privileges.
The driver is embedded in the second-stage component, loadcert.ini, in LZMA-compressed form, then written to the fake Windows Defender installation path used by the campaign.
Once loaded, the user-mode implant opens \.msagent and uses IOCTL requests to register itself as trusted, submit its configured C2 IPv4 address, and identify files and registry paths that require protection.
This architecture gives the backdoor direct control over a rootkit component rather than relying solely on user-mode defense evasion.
The driver can hide and protect the CoolClient-hosting process, prevent external tools from inspecting or terminating it, deny access to designated filesystem paths, and remove selected registry keys or values from enumeration results.
The rootkit’s configuration is stored beneath HKLMSYSTEMRNG, including lists for hidden directories, files, registry objects, ignored images, and protected processes.
A particularly important feature is its ability to obscure C2 visibility. The driver hooks Windows’ Nsiproxy component and filters network information returned to user-mode applications.
Kaspersky Researchers said that, CoolClient has been associated with HoneyMyte activity targeting organizations across Asia and Russia since its public disclosure in 2022.
After the CoolClient implant supplies a C2 IPv4 address through IOCTL 0x2221E0, the rootkit removes matching network records before they are returned to requesting tools.
HoneyMyte Upgrades CoolClient
As a result, incident responders may face a mismatch between an active malicious connection and the telemetry displayed by utilities that depend on affected Windows network interfaces.
The sufficient access to the Service Control Manager and that no 360 Total Security software processes (360sd.exe, zhudongfangyu.exe, or 360desktopservice64.exe) are running.
The campaign chain observed against victims in Myanmar begins with PlugX, which HoneyMyte uses as an initial foothold before deploying CoolClient.
A deceptive C:Program FilesMicrosoftWindows Defender directory, adds Microsoft Defender exclusions for the directory and a renamed sideloader, and uses a legitimate Sangfor executable renamed as defender.exe for DLL sideloading.
The executable loads malicious libngs.dll, which decrypts loadcert.ini; the final cert.ini payload is then injected into synchost.exe for C2 communications and backdoor operations.
Persistence is layered. CoolClient creates an AutoRun entry named goopdate, may install a media_updaten service, and uses scheduled-task execution under SYSTEM in the observed deployment.
The second-stage loader can also use an RPC-based elevation technique combined with PPID spoofing, making an elevated instance appear to originate from a trusted Windows process rather than the original malicious process.
The msagent.sys driver was digitally signed with a certificate issued to “Nanjing Ranyi Technology Co., Ltd.”
The certificate was valid from August 2013 through September 2014, and researchers found older malicious drivers signed with the same certificate but did not establish a direct link between those samples and this CoolClient operation.
The driver’s embedded PDB path includes references to a “Nanjing Laboratory,” although available OSINT did not tie those strings to a known developer or organization.
For defenders, the key takeaway is that CoolClient detection can no longer rely on ordinary process, file, registry, or network enumeration alone.
Hunt for suspicious Sangfor binaries executing from Windows Defender-themed paths; libngs.dll, loadcert.ini, cert.ini, and msagent.sys; the media_updaten service; and suspicious registry content under HKLMSYSTEMRNG.
Analysts should also validate network activity through independent telemetry sources, including firewall, proxy, EDR kernel telemetry, and packet capture, rather than trusting a single host-based network view.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
