HoneyMyte (Mustang Panda) has significantly upgraded the CoolClient backdoor by integrating a signed kernel-mode driver (msagent.sys) that runs as a Windows service. This kernel rootkit enables advanced stealth features such as process hiding, file and registry protection, and network traffic filtering by hooking Nsiproxy to filter C2 addresses. The multi-stage infection chain involves DLL sideloading through a legitimate Sangfor application, persistence via scheduled tasks and AutoRun registry entries, and UAC bypass techniques. CoolClient injects into the synchost.exe process and communicates with the kernel driver through IOCTL requests. The initial infection vector is PlugX malware. Confirmed victim countries include Myanmar, Mongolia, Pakistan, and Russia.

The integration of a signed kernel-mode rootkit driver allows the CoolClient backdoor to operate with high stealth and persistence on infected Windows systems. It can hide processes, protect malicious files and registry keys from detection or removal, and filter network traffic to evade network-based detection of command and control communications. This elevates the threat's ability to maintain long-term access and complicates detection and remediation efforts. The use of UAC bypass and DLL sideloading further enhances its ability to evade security controls and maintain persistence.

No official patch or remediation is indicated in the provided information. Since this is malware deployed by an APT group, mitigation should focus on detection and removal using updated endpoint protection solutions capable of detecting kernel-mode rootkits and associated indicators of compromise. Monitoring for the listed domains and file hashes can aid detection. Network defenses should look for unusual Nsiproxy hooks or filtered C2 traffic. Given the advanced stealth techniques, full system reimaging may be necessary upon detection. Patch status is not yet confirmed — check vendor advisories and threat intelligence updates for remediation guidance.