"The driver is digitally signed with a certificate issued to "Nanjing Ranyi Technology Co., Ltd.," with serial number 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD," according to the Securelist analysis.
Signed kernel driver: msagent.sys and its provenance
The newest CoolClient variant deploys msagent.sys, a kernel-mode driver the backdoor installs as a Windows service. The driver carries a digital signature issued to "Nanjing Ranyi Technology Co., Ltd." that was valid from August 2013 to September 2014, and an embedded PDB path containing Chinese-language strings such as "南京实验室" and "张雪杰云南m." Analysts found older malicious drivers signed with the same certificate compiled around 2013, but the report found no direct evidence linking those older samples to the CoolClient intrusions described here.
Execution chain: PlugX foothold to cert.ini control
Observed intrusions follow a clear multi-stage chain. In the Myanmar campaign the actor used PlugX as the initial post-compromise implant, then staged CoolClient components inside a fake "Microsoft\\Windows Defender" directory. A legitimate Sangfor executable (renamed defender.exe or Sang.exe) is abused for DLL sideloading: it loads a malicious libngs.dll which decrypts and loads loadcert.ini (the second-stage DLL). That DLL handles persistence, privilege elevation, and process injection; after installing the kernel driver it injects the final-stage cert.ini into a synchost.exe instance where C2 communication and regular backdoor activity run.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblemsagent.sys capabilities: IOCTLs, hiding, and network filtering
msagent.sys exposes a device named \\Device\\ToolTool (symbolic link \\DosDevices\\ToolTool) and implements an extensive IOCTL dispatch table. The CoolClient user-mode component issues a small set of IOCTLs during normal initialization — notably:
- 0x222120: register the current CoolClient process as trusted;
- 0x2221E0: pass the configured C2 IPv4 address to the driver;
- 0x2220F0: register filesystem and registry paths for protection (for example the installation directory and the service registry key).
Using those registrations, the driver loads a stealth configuration from \\REGISTRY\\MACHINE\\SYSTEM\\RNG and builds internal AVL lookup structures for directories, files, registry keys and values, and protected or ignored images. With those lists it activates a filesystem minifilter, registry callback, object (process/thread) callbacks, process create/terminate callbacks, and an image-load callback. The driver can deny access to protected files and registry values, remove entries from registry enumeration results, and reduce handle access rights on protected processes.
The driver also implements process hiding (unlinking entries from the ActiveProcessLinks list), kernel module hiding (unlinking entries from PsLoadedModuleList), and a hook into the Nsiproxy driver. When the Nsiproxy hook is active the driver filters network data returned to user mode, removing registered C2 IPv4 addresses from results so applications that rely on Nsiproxy-provided information cannot see the malware’s C2 endpoints.
Persistence and evasion techniques observed on victims
Persistence in observed cases included scheduled tasks and services. The actor created Defender exclusions via WMI calls that add both folder and file exclusions for the fake Defender install and renamed sideloader (defender.exe), copied CoolClient components into the fake directory, and created an autorun registry value named goopdate under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. A scheduled task named "\Microsoft\Windows\Windows Defender Advanced Threat Protection Service" launched defender.exe at startup with SYSTEM privileges. When deployed as a service, CoolClient created or replaced a service named media_updaten to run Sang.exe with the work parameter.
Victimology: countries and deployment pattern
The analysis identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. Across intrusions, CoolClient was consistently deployed as a secondary backdoor after an initial PlugX infection, indicating a recurring operational pattern: PlugX establishes access, and CoolClient — now with a kernel-mode driver — extends stealth and persistence.
What this means for technologists, procurement leaders, and incident responders
- Technologists and security teams: monitor for the specific artefacts observed — msagent.sys (hashes reported in the IOCs), libngs.dll, renamed defender.exe/Sang.exe loads, autorun value "goopdate", scheduled task and service names (media_updaten). Watch for alterations to Microsoft Defender exclusion lists (the WMI MSFT_MpPreference Add ExclusionPath calls) and anomalies in Nsiproxy-provided network listings.
- Procurement and asset owners: the attacker abused a legitimate Sangfor executable for DLL sideloading and placed files under "C:\\Program Files\\Microsoft\\Windows Defender\\", demonstrating that directory and file-name mimicry remain effective — validation of code-signing and binary provenance across supplier-supplied tooling remains important.
- Incident responders and defenders in affected countries: expect a multi-stage cleanup challenge. The driver protects files and registry keys and hides processes, so removal requires both user-mode and kernel-level remediation steps and attention to the driver’s registry configuration under \\SYSTEM\\RNG.
Conclusion: CoolClient's move from a user-mode backdoor to a paired user-mode implant and a signed kernel driver changes the effort required to find and remove it. The driver-based protections — process hiding, filesystem and registry concealment, kernel module unlinking, and Nsiproxy filtering — materially raise the bar for visibility and remediation on infected hosts. The IOCs published with the analysis (hashes for msagent.sys and libngs.dll, example installation paths and domains) should be triaged and matched against local telemetry as a priority.
