Mustang Panda’s CoolClient Malware Gets Kernel-Level Windows Rootkit to Hide From Defenders
Harish Kumar 
Kaspersky’s GReAT researchers have disclosed that HoneyMyte, the China-aligned APT group also tracked as Mustang Panda, has armed its long-running CoolClient backdoor with a signed kernel-mode Windows driver, turning a capable espionage tool into a stealth-first rootkit platform.
CoolClient has been on defenders’ radar since Sophos first documented it in 2022, with Trend Micro expanding the picture in 2023 and Kaspersky detailing browser-stealing and traffic-interception upgrades in 2025.
The latest variant, detailed in a report published August 14, 2026, adds a new final act: a signed driver, msagent.sys, that the user-mode backdoor loads as a Windows service and controls through IOCTL requests.
Mustang Panda’s CoolClient Malware
Infections analyzed in a Myanmar-based intrusion trace back to PlugX, which HoneyMyte continues to use as its initial post-compromise implant before pivoting to CoolClient as a secondary backdoor.
Operators added Microsoft Defender exclusions for a spoofed “Windows Defender” folder, then dropped a renamed Sangfor binary (defender.exe) to sideload the malicious libngs.dll, the same DLL-sideloading tradecraft the group has relied on for years.
The infection unfolds in layers: libngs.dll decrypts and loads loadcert.ini (formerly loader.dat), which handles persistence, UAC bypass, and process injection into synchost.exe before deploying the driver and finally launching cert.ini (formerly main.dat), the component that handles C2 communication.
Persistence is doubled up through both an AutoRun registry key and a Windows service, while privilege escalation uses an RPC-based technique with parent-process-ID spoofing, a method first described by Google Project Zero, to make the elevated process appear spawned by a trusted Windows binary like winver.exe.
Once loaded with sufficient privileges (full SCM access plus SeTcbPrivilege), msagent.sys registers the CoolClient process as “trusted,” accepts the configured C2 IPv4 address, and whitelists filesystem and registry paths for protection, all via three primary IOCTL calls, though the driver implements 33 handlers in total.
Its capabilities extend to unlinking processes from the active process list, hiding kernel modules from PsLoadedModuleList, filtering C2 IP addresses out of Nsiproxy network queries, and even patching arbitrary kernel memory.
The driver itself carries a certificate issued to “Nanjing Ranyi Technology Co., Ltd.,” valid only from 2013 to 2014, and a PDB path referencing a “Nanjing Laboratory” project; Kaspersky says it could not link to any known developer or organization.
Kaspersky identified confirmed government victims in Myanmar, Mongolia, Pakistan, and Russia, consistent with HoneyMyte’s established footprint of targeting diplomatic and state entities across Asia.
The design mirrors kernel-mode enhancements the group previously rolled out in its ToneShell backdoor in late 2025, suggesting rootkit development is now a standing investment for the group rather than a one-off experiment.
Security teams should treat kernel-driver installation events, unexpected Sangfor or Defender-path DLL sideloads, and synchost.exe process injection as high-priority signals.
Because the rootkit can hide files, registry keys, and even network artifacts from standard tooling, EDR products with kernel-level visibility and driver-blocklisting (via Microsoft’s vulnerable driver list mechanisms) are now essential rather than optional against this actor.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
