APT Group HoneyMyte Enhances CoolClient Backdoor with Kernel-Level Rootkit
The HoneyMyte APT group has significantly upgraded its CoolClient backdoor with a kernel-mode driver, enabling advanced stealth capabilities and deeper system compromise on Windows.
The advanced persistent threat (APT) group HoneyMyte, also known as Mustang Panda, has been observed deploying a substantially evolved version of its CoolClient backdoor. This latest iteration incorporates a kernel-mode driver, transforming the malware into a sophisticated rootkit designed for enhanced stealth and persistence on Windows systems. CoolClient, a long-standing tool in HoneyMyte's arsenal, has historically provided capabilities such as keylogging, credential harvesting, file management, and plugin-based extensions, primarily targeting organizations across Asia and Russia in cyber-espionage campaigns.
Previous analyses by Sophos and Trend Micro detailed earlier versions of CoolClient, with a 2025 analysis highlighting advancements in clipboard theft and HTTP traffic interception. The current evolution, identified in late 2025 and early 2026, marks a significant leap by introducing a signed kernel-mode driver. This driver operates as a Windows service, communicating with the user-mode backdoor via IOCTL requests. Its primary function is to obscure the presence of the CoolClient process, protect associated files and registry entries, and prevent any form of inspection or modification by security software or administrators.
The technical implementation of the kernel-mode driver bears similarities to rootkit functionalities seen in other malware families, such as ToneShell. However, CoolClient's driver features dedicated IOCTL handlers that facilitate direct communication between the user-mode backdoor and the kernel component. This integration allows for more granular control and deeper system manipulation, making the malware significantly harder to detect and remove.
In observed intrusions, particularly an attack campaign targeting Myanmar, HoneyMyte employed the PlugX implant as an initial post-compromise tool to deploy the updated CoolClient components. Before deployment, attackers meticulously configured Microsoft Defender to exclude specific directories and executables, including a fake Windows Defender installation folder and a renamed sideloader executable masquerading as 'defender.exe'. This pre-configuration aims to preemptively disable security monitoring for the malware's components.
Persistence was established through a scheduled task designed to launch the malicious 'defender.exe' with SYSTEM privileges during system startup. This ensures that the malware re-establishes its presence and operational capabilities even after system reboots. The legitimate Sangfor application, typically named 'Sang.exe', was often renamed to 'defender.exe' to serve as the DLL sideloader, further camouflaging the malicious activity.
The execution chain of the latest CoolClient variant follows a multi-stage process. The initial stage involves the legitimate Sangfor application loading a malicious DLL, 'libngs.dll', through DLL sideloading. This DLL, while exporting numerous dummy functions to appear legitimate, contains obfuscated code in its DllMain entry point. This code is responsible for decrypting and loading the second-stage DLL, 'loadcert.ini', into memory.
The second-stage component, 'loadcert.ini', prepares the execution environment and handles the deployment of the kernel-mode driver. It checks its execution context and, if running under the original sideloaded process, initiates the setup for the rootkit. This stage is critical for establishing the malware's deep system integration and its ability to evade detection by hiding its core components and processes from the operating system's user-mode interfaces.
This newly enhanced CoolClient variant, with its kernel-mode rootkit capabilities, represents a significant escalation in HoneyMyte's operational sophistication. The group's continued use and evolution of this backdoor underscore its persistent focus on cyber-espionage and its commitment to developing advanced tools for covert operations across Asia.