HoneyMyte’s Escalation in Espionage Tactics: The Upgrade of the CoolClient Backdoor
Recently, cybersecurity researchers have uncovered significant advancements by HoneyMyte, a China-aligned espionage group also known as Mustang Panda. This group has upgraded its notorious CoolClient backdoor to include a signed Windows kernel-mode rootkit, an alarming development that allows it to effectively conceal its malicious activities, including malware artifacts and command-and-control (C2) infrastructure, from security measures employed by various organizations.
The introduction of the kernel-mode rootkit represents a pivotal shift in the group’s post-compromise tradecraft, specifically shifting its defensive strategies below the user-mode layer. Most endpoint inspection tools primarily operate within this realm, making it considerably more challenging for them to detect and neutralize the observer’s malicious actions. As such, the evolution in HoneyMyte’s tactics signifies a marked escalation in their operational capabilities.
Previous iterations of the CoolClient backdoor provided a suite of functionalities that supported various nefarious activities. These included reconnaissance operations, file manipulations, keylogging, clipboard interception, credential harvesting, and an extensible plugin framework. A notable update in 2025 extended the capabilities further by adding features aimed at browser-centered credential theft and HTTP traffic interception, reflecting the malware’s expansion beyond conventional remote access functionalities, further emphasizing HoneyMyte’s adaptability in a rapidly evolving cyber landscape.
The most recently analyzed version showcases a kernel driver called msagent.sys, which is installed as a Windows service after CoolClient acquires the necessary privileges within the compromised system. This driver is embedded within a secondary component, loadcert.ini, and is compressed using LZMA format. Subsequently, it is written to a deceitful Windows Defender installation path tailored to the malicious campaign.
Once successfully loaded, the user-mode implant manipulates the \.\msagent interface utilizing IOCTL requests to recognize itself as a trusted application. It also communicates its configured C2 IPv4 address back to the malware’s infrastructure, while also marking specific files and registry paths for protection. This sophisticated architecture allows the backdoor to maintain direct control over a rootkit component, eschewing the traditional reliance on mere user-mode evasion tactics, which often prove less effective.
The capabilities of the rootkit extend to the concealment and protection of the CoolClient-hosting process, hindering external tools from inspecting or terminating the process. Additionally, it can deny access to specific filesystem paths and eliminate selected registry entries from being visible in enumeration activities. Notably, the rootkit’s configuration is stored in the system registry under HKLM\SYSTEM\RNG, detailing lists for hidden directories, files, registry objects, and ignored images, reinforcing the adversarial nature of the threat.
A salient aspect of the rootkit is its capacity to obscure visibility into the C2 operations. It achieves this by hooking into the Windows Nsiproxy component, consequently filtering network information returned to user-mode applications. Researchers at Kaspersky indicated that the CoolClient backdoor has been associated with HoneyMyte’s activities targeting various organizations across Asia and Russia since its initial public disclosure in 2022.
As part of the operational chain witnessed against victims in Myanmar, the attack typically commences with PlugX, which serves as the initial foothold for HoneyMyte, paving the way for the deployment of CoolClient. To create a facade of legitimacy, the campaign employs a misleading directory path resembling C:\Program Files\Microsoft\Windows Defender, which provides exclusions for legitimate files and utilizes a legitimate Sangfor executable renamed to defender.exe for DLL sideloading. Consequently, this executable loads a malicious component known as libngs.dll, which decrypts loadcert.ini; with the ultimate payload then injected into synchost.exe for C2 communications and operational functionality.
The persistence mechanisms deployed by CoolClient are notably intricate. The malware creates an AutoRun entry named goopdate and may also install a media_updaten service. Additionally, it uses scheduled-task execution under the SYSTEM context within observed deployments, further complicating its detection.
Moreover, the second-stage loader also incorporates an elevation technique based on RPC combined with PPID spoofing, cleverly making an elevated instance appear to stem from a trusted Windows process rather than the original malicious one.
The presence of the msagent.sys driver, which was digitally signed with a certificate linked to "Nanjing Ranyi Technology Co., Ltd.," raises eyebrows. Although the certificate was valid from August 2013 to September 2014, researchers did manage to identify older malicious drivers signed with the same certificate, however, a direct association with the current CoolClient operation remains unconfirmed.
For cybersecurity defenders, the message is clear: relying solely on typical detection methods—focusing on process, file, registry, or network enumeration—will not suffice against this revamped malware. Vigilance is critical, and defenders should probe for suspicious Sangfor binaries operating within Windows Defender-themed directories, as well as the aforementioned files and services linked to the operation.
In conclusion, the evolution of HoneyMyte’s CoolClient backdoor encapsulates a concerning trajectory in cyber espionage. The ability to innovate and adapt with intricate evasion and concealment strategies represents a sophisticated threat landscape that necessitates robust cybersecurity protocols, active threat-hunting methodologies, and comprehensive telemetric validation across various channels. This ongoing cat-and-mouse game underscores the need for constant vigilance in safeguarding digital infrastructures.