**HoneyMyte**, a sophisticated threat actor also recognized as **Mustang Panda**, is deploying an evolved version of its **CoolClient** backdoor. This iteration includes a signed Windows kernel-mode rootkit, a critical enhancement for evading detection. Cybersecurity vendor **Kaspersky** identified victims in Myanmar, Mongolia, Pakistan, and Russia, with government entities among those targeted. **CoolClient** is consistently deployed as a secondary backdoor, typically following an initial **PlugX** infection. ## Kernel Component Deployment The kernel component is activated only when **CoolClient** secures full access to the Service Control Manager (SCM) and possesses the `SeTcbPrivilege` privilege. Should these prerequisites not be met, the malware bypasses driver deployment and proceeds with its final-stage implant. **Kaspersky** has released Indicators of Compromise (IoCs), including file hashes, paths, and C2 domains. "Our analysis confirms that the investigated malware is a new **CoolClient** variant associated with the **HoneyMyte** threat group. While the overall execution flow remains consistent with previously documented **CoolClient** variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware’s stealth capabilities," **Kaspersky** stated. According to **Kaspersky**'s analysis, the latest **CoolClient** variant can install the driver as a Windows service and manage it from the user-mode backdoor via Input/Output Control (IOCTL) requests. **CoolClient**'s capabilities include keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and additional functionalities delivered through plugins. ## PlugX Orchestrates CoolClient Deployment In a campaign targeting Myanmar, **HoneyMyte** leveraged **PlugX** as the initial post-compromise implant to deploy **CoolClient**. The attackers also configured **Microsoft Defender** exclusions for a counterfeit Windows Defender installation directory and a renamed sideloading executable.  The threat actor copied the malicious components into the directory, renamed a legitimate **Sangfor** executable to `defender.exe` for DLL sideloading, and established persistence through a scheduled task that launched the binary with `SYSTEM` privileges during system startup. Execution commences when the legitimate **Sangfor** application loads a malicious `libngs.dll`, which then decrypts and executes the second-stage component `loadcert.ini`. This component handles persistence, registry modifications, User Account Control (UAC) bypass, process injection, driver deployment, and loading the final-stage `cert.ini` implant responsible for C2 communications and backdoor functionality. The second-stage malware creates an AutoRun registry entry named `goopdate` and can install a Windows service named `media_updaten`. It also employs a Remote Procedure Call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named `synchost.exe`. ## Signed msagent.sys Driver Adds Kernel-Level Stealth When the necessary privileges are available, `loadcert.ini` extracts an embedded LZMA-compressed kernel driver, writes it to disk as `msagent.sys`, and creates and initiates a driver service named `msagent`. **Kaspersky** noted that the driver is digitally signed with a certificate issued to **Nanjing Ranyi Technology Co., Ltd.**, which was valid from August 2013 to September 2014. The security firm identified several older malicious drivers signed with the same certificate and compiled around 2013, though no direct link to **CoolClient** activity was established. Once loaded, the driver receives configuration from the **CoolClient** user-mode component through IOCTL requests. The three requests observed in the analyzed sample during normal execution are: * `0x222120`, which registers the current **CoolClient** process as a trusted process with the driver. * `0x2221E0`, which passes the configured C2 IPv4 address to the driver. * `0x2220F0`, which registers filesystem and registry paths that require protection. The first request allows the registered **CoolClient** process to access protected files, registry keys, and processes. The third registers its installation directory and service registry path, ensuring these objects are shielded from inspection, modification, and deletion. The rootkit loads its stealth configuration from `\REGISTRY\MACHINE\SYSTEM\RNG` and utilizes separate configuration entries for directories, files, registry keys and values, and processes that should be hidden, protected, or ignored. It registers filesystem, registry, process, object, and image-load callbacks that leverage these entries when managing activity on the infected Windows system. For process protection, the driver can reduce the access rights granted when another process attempts to open a handle to a protected process, preventing operations such as termination and code injection. In the analyzed sample, **Kaspersky** found that the protected process contained **CoolClient** code injected into `synchost.exe`. The driver also implements process hiding by unlinking entries from the Windows active process list, uses a filesystem minifilter to deny access to protected files and directories, and registers a registry callback that removes protected keys and values from enumeration results and blocks attempts to modify or delete them. A separate hook installed in the Windows **Nsiproxy** driver filters configured C2 IPv4 addresses from network information returned to user mode. **Kaspersky** discovered that `msagent.sys` implements 33 IOCTL handlers, including functionality for hiding processes and kernel modules, manipulating registry values, and interacting with kernel notification callbacks. The researchers noted that the analyzed **CoolClient** sample only invoked the three IOCTLs listed above during normal execution, with the remaining handlers unobserved. Among the indicators shared by **Kaspersky** are the following hashes: * `2d7c8780e97409770a9d4f31c66c9d63` - `msagent.sys` * `9460E150E1981D5C165043520c5c12fe` - `msagent.sys` * `9717f005c5fb98e08d2ad983d88f94ee` - `libngs.dll` * `F518D8E5FE70D9090F6280C68A95998F` - `libngs.dll` This development follows more than six months after **Kaspersky** initially disclosed a newer **CoolClient** variant used in a campaign targeting Pakistan and Myanmar, which also dropped and executed a previously unseen rootkit. **Kaspersky** had also separately documented a different **HoneyMyte** kernel-mode rootkit in December 2025 that was used to load the **ToneShell** backdoor. The company noted that the overall design of the new **CoolClient** driver is comparable to the kernel-mode enhancements seen with **ToneShell**, while the **CoolClient** component exposes dedicated IOCTL handlers for direct communication with the user-mode backdoor.