HoneyMyte APT Group Enhances CoolClient Backdoor with Kernel-Mode Rootkit Capabilities

Introduction

The HoneyMyte APT group, also known as Mustang Panda, has recently enhanced its CoolClient backdoor with significant kernel-mode rootkit capabilities. This evolution marks a notable shift in their cyber-espionage tactics, which have historically targeted organizations across Asia and Russia. The CoolClient backdoor is equipped with various functionalities, including keylogging, clipboard theft, credential harvesting, file management, and system reconnaissance, alongside plugin-based extensions. The latest variant, identified in late 2025 and early 2026, introduces a signed kernel-mode driver that operates as a Windows service, allowing for stealthier operations by hiding the CoolClient process and protecting its associated files and registry entries from inspection or modification. This development is detailed in a recent analysis by the research team at Securelist.

Technical Analysis

In a campaign targeting Myanmar, the HoneyMyte group utilized PlugX as the initial implant to deploy the CoolClient components. Prior to the malware deployment, the attackers configured Microsoft Defender to exclude the fake Windows Defender installation directory and the renamed sideloader executable, defender.exe. This tactic is indicative of their efforts to evade detection by security software.

The deployment process involved creating a fake Windows Defender directory, copying the CoolClient components into it, and renaming a legitimate Sangfor executable to serve as the DLL sideloader. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup.

CoolClient Components

The latest CoolClient variant follows a multi-stage execution chain, with each component serving a specific role:

Upon execution, defender.exe sideloads libngs.dll, initiating the malware’s execution chain. The first-stage loader is designed to appear legitimate by exporting dummy functions, while the actual malicious logic is executed from DllMain, which loads and decrypts the second-stage DLL, loadcert.ini.

Kernel-Mode Driver Deployment

The second-stage DLL, loadcert.ini, prepares the execution environment and can deploy the kernel-mode driver if the necessary privileges are available. This driver, named msagent.sys, is extracted from loadcert.ini and installed as a Windows service. It communicates with the user-mode component through IOCTL requests, allowing for enhanced stealth capabilities.

Once initialized, the driver registers the CoolClient process as a trusted entity, enabling it to interact with protected files and registry keys. The driver also implements various IOCTL handlers that facilitate process hiding, file protection, and network data filtering, significantly complicating detection efforts.

Victimology and Attribution

The latest CoolClient variant has been observed targeting organizations in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. The deployment of CoolClient as a secondary backdoor following a PlugX infection indicates a consistent operational pattern for the HoneyMyte group.

This analysis confirms that the malware is a new variant of CoolClient associated with the HoneyMyte threat group. The introduction of a kernel-mode driver enhances the malware’s stealth capabilities, allowing it to evade detection more effectively than previous iterations.

Conclusion

The evolution of the CoolClient backdoor into a more sophisticated malware variant with kernel-mode capabilities represents a significant advancement in the HoneyMyte group’s cyber-espionage toolkit. By integrating a kernel-mode driver, the group enhances its ability to conceal its activities and maintain persistence within compromised systems. This development underscores the ongoing need for robust detection and response strategies to combat advanced persistent threats.