CoolClient backdoor goes deeper: Windows kernel rootkit added

HoneyMyte APT group (also known as Mustang Panda) has significantly upgraded its CoolClient backdoor with kernel-level rootkit capabilities. The latest variant deploys a signed kernel-mode driver (msagent.sys) as a Windows service, enabling advanced stealth features including process hiding, file and registry protection, and network traffic filtering. The multi-stage malware uses DLL sideloading through a legitimate Sangfor application, establishes persistence via scheduled tasks and AutoRun entries, and implements UAC bypass techniques. CoolClient now injects into synchost.exe and communicates with the kernel driver through IOCTL requests. The driver hooks Nsiproxy to filter C2 addresses from network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with PlugX serving as the initial infection vector before CoolClient deployment.

• CoolClient backdoor updated, new data stealing tools usedMalware2026-01-27
• TA416 resumes European government espionage campaignsMalware2026-04-07
• The HoneyMyte APT now protects malware with a kernel-mode rootkitMalware2025-12-29
• The banana stand: brokering and managing infections across Asia using MQTTMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10