"Our analysis confirms that the investigated malware is a new CoolClient variant associated with the HoneyMyte threat group. While the overall execution flow remains consistent with previously documented CoolClient variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware’s stealth capabilities," Kaspersky said.
HoneyMyte (aka Mustang Panda) and the targets Kaspersky identified
Kaspersky reported that the threat actor known as HoneyMyte, also tracked as Mustang Panda, has deployed an updated CoolClient backdoor that can use a signed Windows kernel-mode rootkit to hide and protect processes, files, registry objects, and C2 network information. The vendor said it identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, and that CoolClient was consistently observed as a secondary backdoor following a PlugX infection.
How PlugX was used to deliver CoolClient in a Myanmar campaign
In the Myanmar-targeted campaign described by Kaspersky, PlugX served as the initial post-compromise implant that deployed CoolClient. The actor copied malware components into a directory, added Microsoft Defender exclusions for a fake Windows Defender installation directory and a renamed sideloading executable, and renamed a legitimate Sangfor executable to defender.exe to enable DLL sideloading. Persistence was established via a scheduled task that launched the binary with SYSTEM privileges at startup.
Execution began when the legitimate Sangfor application loaded a malicious libngs.dll. That DLL decrypted and executed the second-stage loadcert.ini component, which handled persistence, registry modifications, a User Account Control bypass, process injection, driver deployment, and loading the final-stage cert.ini implant responsible for command-and-control communications and backdoor functionality. The second-stage created an AutoRun registry entry named goopdate, could install a Windows service named media_updaten, and used an RPC-based process creation technique with PPID spoofing to relaunch elevated before injecting into a process named synchost.exe.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSigned msagent.sys driver adds kernel-level hiding and protection
When CoolClient has full access to the Service Control Manager and the SeTcbPrivilege privilege, loadcert.ini extracts an embedded LZMA-compressed kernel driver, writes it to disk as msagent.sys, and creates and starts a driver service named msagent. Kaspersky said the driver is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. that was valid from August 2013 to September 2014.
The driver receives configuration from the CoolClient user-mode component via IOCTL requests. Kaspersky observed three IOCTLs used during normal execution: 0x222120 to register the current CoolClient process as trusted with the driver; 0x2221E0 to pass the configured C2 IPv4 address; and 0x2220F0 to register filesystem and registry paths that should be protected. The rootkit stores its stealth configuration in \\REGISTRY\\MACHINE\\SYSTEM\\RNG and maintains separate configuration entries for directories, files, registry keys and values, and processes to be hidden, protected, or ignored.
The driver registers filesystem, registry, process, object, and image-load callbacks and implements protections that include reducing access rights when another process opens a handle to a protected process (preventing termination and code injection), unlinking processes from the Windows active process list to hide them, employing a filesystem minifilter to deny access to protected files and directories, and installing a registry callback that removes protected keys and values from enumeration results and blocks modification or deletion. A separate hook in the Windows Nsiproxy driver filters configured C2 IPv4 addresses from network information returned to user mode.
Technical indicators and capability footprint
Kaspersky said msagent.sys implements 33 IOCTL handlers in total, although the analyzed CoolClient sample invoked only the three handlers listed above during normal execution. The vendor shared file hashes as indicators of compromise, including:
- 2d7c8780e97409770a9d4f31c66c9d63 — msagent.sys
- 9460E150E1981D5C165043520c5c12fe — msagent.sys
- 9717f005c5fb98e08d2ad983d88f94ee — libngs.dll
- F518D8E5FE70D9090F6280C68A95998F — libngs.dll
Kaspersky additionally published file paths and C2 domains as IoCs. The company noted several older malicious drivers signed with the same Nanjing Ranyi certificate and compiled around 2013 but said it found no evidence directly connecting those samples to the CoolClient activity it analyzed.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: watch for indicators such as msagent.sys service creation, the libngs.dll sideload via a renamed Sangfor binary (defender.exe), scheduled tasks that run binaries at SYSTEM privilege, the AutoRun registry entry goopdate, and the media_updaten service name. Kernel-level callbacks and an Nsiproxy hook indicate detection will require visibility beyond user-space process lists and standard enumeration.
- Policymakers and regulators: the driver’s digital signature (issued to Nanjing Ranyi Technology Co., Ltd., valid Aug 2013–Sep 2014) and Kaspersky’s finding of older signed drivers compiled around 2013 underscore how code-signing and historical certificate records can appear in malicious toolchains and merit attention when evaluating driver provenance.
- Affected enterprises and government operators: Kaspersky identified confirmed government victims across four countries and observed CoolClient consistently deployed as a secondary backdoor after PlugX. Those operators should consider the possibility of layered implants and kernel-mode components that can hide files, services, and network artifacts from ordinary inspection.
CoolClient’s new kernel-mode component expands the backdoor’s ability to conceal itself and protect its components from user-mode inspection and modification. Kaspersky’s published IoCs — including msagent.sys and libngs.dll hashes, file paths, and C2 domains — provide concrete starting points for detection and response in environments that may have seen PlugX activity. For the moment, the record is clear: the variant binds user-mode backdoor control to a signed kernel driver with dedicated IOCTL handlers, elevating CoolClient’s stealth and persistence options.
Full technical details and the indicators published by Kaspersky are linked in the original reporting: https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html
