APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel

The HoneyMyte threat group, also known as Mustang Panda, has deployed an evolved variant of the CoolClient backdoor targeting government organizations in Asia and Russia, specifically in Myanmar, Mongolia, and Pakistan. This version marks a significant shift in capability by introducing a signed kernel-mode driver, msagent.sys, which provides rootkit functionality. This driver allows the malware to hide its processes, files, and registry entries from the operating system and security software, while also filtering network data to conceal C2 communications.
The infection chain typically begins with PlugX, which facilitates the deployment of CoolClient. The malware employs sophisticated evasion techniques, including DLL sideloading via a legitimate Sangfor executable and an RPC-based UAC bypass to gain elevated privileges. Once active, the malware injects its final stage into synchost.exe. While the group's overall objectives remain consistent with previous cyber-espionage campaigns, the integration of kernel-level stealth indicates a strategic investment in long-term persistence and defense evasion.

* HoneyMyte (Mustang Panda) is the threat actor attributed to the CoolClient backdoor.
* Targets include organizations and government entities in Myanmar, Mongolia, Pakistan, and Russia.
* The malware consists of multiple components: defender.exe/Sang.exe, libngs.dll, loadcert.ini, cert.ini, and time.ini.
* A signed kernel-mode driver, msagent.sys, is deployed as a Windows service.
* The driver is digitally signed by "Nanjing Ranyi Technology Co., Ltd." with a certificate valid from 2013 to 2014.
* Initial deployment in Myanmar used PlugX as the post-compromise implant.
* Persistence is established via scheduled tasks and AutoRun registry keys (goopdate).
* The malware injects its final stage into the synchost.exe process.
* The driver uses IOCTL requests (including 0x222120, 0x2221E0, and 0x2220F0) to communicate with the user-mode component.
* Rootkit capabilities include hiding files in directories such as "C:\Program Files\Microsoft\Windows Defender\".
* The driver hooks Nsiproxy to filter C2 IPv4 addresses from network information.

The strongest version of this narrative is that a sophisticated state-aligned actor is iteratively upgrading its toolkit to defeat modern endpoint detection and response (EDR) systems. By moving from user-mode plugins to kernel-mode rootkits, the actor is effectively attempting to "own" the truth of the operating system, ensuring that the tools used to find the malware are the same tools the malware is manipulating.
This is a classic escalation pattern in the arms race between malware authors and security vendors. The shift to a signed, though expired, driver suggests a reliance on legacy trust—exploiting the fact that some systems may still trust certificates from a decade ago or that the signature provides just enough legitimacy to bypass basic checks.
The root cause is the inherent vulnerability of the monolithic kernel architecture in Windows, where a single signed driver can grant absolute control over system visibility. This echoes the "Bring Your Own Vulnerable Driver" (BYOVD) trend, though here the driver is purpose-built for stealth rather than exploiting a known flaw in a third-party driver.
The implication is a diminishing return on traditional forensics. When the kernel is compromised, the "ground truth" provided by the OS is no longer reliable. This forces defenders to move toward out-of-band memory analysis and hardware-level telemetry, increasing the cost and complexity of defense.
Bridge Questions:
1. If the driver's certificate expired in 2014, why is it still effective for deployment in 2025/2026?
2. What does the reuse of a specific Sangfor executable suggest about the actor's preference for specific "living-off-the-land" binaries?
Counterstrike Scan: If this were an influence campaign, the playbook would involve emphasizing the "unstoppable" nature of the rootkit to drive fear and push a specific security product. However, the content remains focused on technical mechanics and IOCs rather than a sales pitch.
Patterns detected: none