HoneyMyte’s CoolClient Backdoor Gets Kernel Rootkit Upgrade, Targets Asia and Russia
Kiran 
Kaspersky’s GReAT team has uncovered a major evolution in the toolkit of HoneyMyte (also tracked as Mustang Panda), revealing that the group’s long-running CoolClient backdoor now deploys a signed kernel-mode driver to cloak itself from defenders across compromised Windows systems in Asia and Russia.
CoolClient has been a fixture of HoneyMyte’s espionage operations since Sophos first flagged it in 2022, with Trend Micro documenting further refinements in 2023 and Kaspersky itself detailing a browser-stealer variant in 2025.
The newest iteration, observed in intrusions throughout late 2025 and into 2026, adds a driver component that communicates with the user-mode backdoor via IOCTL requests, a design philosophy the researchers say mirrors kernel-mode upgrades HoneyMyte previously built into its ToneShell malware.
HoneyMyte’s CoolClient Backdoor Gets Kernel Rootkit Upgrade
In the Myanmar intrusion GReAT analyzed, the attackers used PlugX as an initial foothold before deploying CoolClient, first exempting a fake “Windows Defender” directory from Microsoft Defender scanning and sideloading a renamed Sangfor executable to launch the malware chain. Persistence was locked in through a SYSTEM-level scheduled task disguised as a Defender ATP service.
The infection unfolds across staged components libngs.dll, loadcert.ini, cert.ini, and time.ini each decrypted and handed off in sequence, ultimately injecting into a synchost.exe process rather than the write.exe process used in earlier variants.
Along the way, CoolClient establishes AutoRun persistence, installs itself as a Windows service, and executes an RPC-based UAC bypass technique reusing a method first documented by Google Project Zero to relaunch itself with elevated privileges while spoofing a trusted parent process.
The centerpiece of this update is msagent.sys, a kernel driver bearing a PDB path referencing a “Nanjing Laboratory” and signed with a decade-old, long-expired certificate issued to Nanjing Ranyi Technology Co., Ltd. a certificate GReAT found reused on other malicious drivers dating to 2013, though no direct link to HoneyMyte’s broader operations was confirmed.
Once loaded, the driver reads its configuration from the registry to determine which files, directories, registry keys, and processes to conceal.
It registers object, process, and image-load callbacks to shield the injected CoolClient process from termination or inspection, deploys a filesystem minifilter to hide protected paths, and installs a registry callback that strips protected keys from enumeration or blocks access outright.
It even hooks the Nsiproxy driver to scrub the malware’s C2 IP address from network queries. Of 33 available IOCTL handlers, including capabilities for shellcode injection, arbitrary kernel memory writes, and module hiding, the observed sample used just three in normal operation.
This upgrade signals that HoneyMyte is systematically hardening its malware family against modern EDR and forensic tooling rather than simply iterating on backdoor features.
The reuse of ToneShell’s kernel-mode blueprint suggests a shared rootkit development pipeline within the group’s toolset, meaning similar driver-based stealth could surface in other HoneyMyte implants going forward.
For organizations in South and Southeast Asia and Russia particularly government entities, which GReAT confirmed among the victims this reinforces the value of monitoring for unsigned or anomalously-signed driver loads, unusual Service Control Manager activity, and PlugX infections as an early warning sign that a CoolClient deployment, and now a kernel rootkit, may follow.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
