The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.
Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, with CoolClient consistently deployed as a secondary backdoor following a PlugX infection.
The kernel component is deployed when CoolClient has full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If those conditions are not met, the malware skips driver deployment and proceeds to the final-stage implant.
Kaspersky has also published file hashes, paths, and C2 domains as indicators of compromise (IoCs).
"Our analysis confirms that the investigated malware is a new CoolClient variant associated with the HoneyMyte threat group. While the overall execution flow remains consistent with previously documented CoolClient variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware’s stealth capabilities," Kaspersky said.
According to Kaspersky's new analysis, the latest CoolClient variant can install the driver as a Windows service and control it from the user-mode backdoor through input/output control (IOCTL) requests.
CoolClient supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and additional functionality delivered through plugins.
PlugX Deploys the CoolClient Components
In one campaign targeting Myanmar, Kaspersky said HoneyMyte used PlugX as the initial post-compromise implant to deploy CoolClient, adding Microsoft Defender exclusions for a fake Windows Defender installation directory and a renamed sideloading executable.
The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.
Execution begins when the legitimate Sangfor application loads a malicious libngs.dll, which decrypts and executes the second-stage component loadcert.ini. The latter handles persistence, registry modifications, User Account Control (UAC) bypass, process injection, driver deployment, and loading the final-stage cert.ini implant responsible for C2 communications and backdoor functionality.
The second-stage malware creates an AutoRun registry entry named goopdate and can install a Windows service named media_updaten. It also implements a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named synchost.exe.
Signed msagent.sys Driver Adds Kernel-Level Stealth
When the required privileges are available, loadcert.ini extracts an embedded LZMA-compressed kernel driver, writes it to disk as msagent.sys, and creates and starts a driver service named msagent.
Kaspersky said the driver is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. that was valid from August 2013 to September 2014.
The security company said it identified several older malicious drivers signed with the same certificate and compiled around 2013, although it found no evidence directly connecting those samples to the CoolClient activity.
Once loaded, the driver receives configuration from the CoolClient user-mode component through IOCTL requests. The three requests used by the analyzed sample during normal execution are -
- 0x222120, which registers the current CoolClient process as a trusted process with the driver.
- 0x2221E0, which passes the configured C2 IPv4 address to the driver.
- 0x2220F0, which registers filesystem and registry paths that should be protected.
The first request allows the registered CoolClient process to access protected files, registry keys, and processes, while the third registers its installation directory and service registry path so those objects can be protected from inspection, modification, and deletion.
The rootkit loads its stealth configuration from \REGISTRY\MACHINE\SYSTEM\RNG and uses separate configuration entries for directories, files, registry keys and values, and processes that should be hidden, protected, or ignored.
It registers filesystem, registry, process, object, and image-load callbacks that use these entries when handling activity on the infected Windows system.
For process protection, the driver can reduce the access rights granted when another process attempts to open a handle to a protected process, preventing operations such as termination and code injection. In the analyzed sample, Kaspersky said the protected process contained CoolClient code injected into synchost.exe.
The driver also implements process hiding by unlinking entries from the Windows active process list, uses a filesystem minifilter to deny access to protected files and directories, and registers a registry callback that removes protected keys and values from enumeration results and blocks attempts to modify or delete them.
A separate hook installed in the Windows Nsiproxy driver filters configured C2 IPv4 addresses from network information returned to user mode.
Kaspersky found that msagent.sys implements 33 IOCTL handlers, including functionality for hiding processes and kernel modules, manipulating registry values, and interacting with kernel notification callbacks.
The researchers said the analyzed CoolClient sample invoked only the three IOCTLs listed above during normal execution, with the remaining handlers not observed in use.
Among the indicators shared by Kaspersky are the following hashes -
- 2d7c8780e97409770a9d4f31c66c9d63 - msagent.sys
- 9460E150E1981D5C165043520c5c12fe - msagent.sys
- 9717f005c5fb98e08d2ad983d88f94ee - libngs.dll
- F518D8E5FE70D9090F6280C68A95998F - libngs.dll
The development comes more than six months after Kaspersky disclosed that a newer CoolClient variant used in a campaign targeting Pakistan and Myanmar dropped and executed a previously unseen rootkit, as The Hacker News reported in January 2026.
Kaspersky had separately documented a different HoneyMyte kernel-mode rootkit in December 2025 that was used to load the ToneShell backdoor. The company said the overall design of the new CoolClient driver is comparable to the kernel-mode enhancements seen with ToneShell, while the CoolClient component exposes dedicated IOCTL handlers for direct communication with the user-mode backdoor.
