Vendor

Sangfor

0 mentions in 7 days · 0 in 30 days · 2 total · first seen Aug 15, 2026 · last Aug 16, 2026

Timeline2 articles

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security AffairsAug 16, 17:18 UTC · Aug 16, 2026Threat actor in the wild1

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.

Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild1

Appears with

threat actor HoneyMyte 2 threat actor Mustang Panda 2 malware PlugX 2 product CoolClient 2 product Microsoft Defender 2 vendor Kaspersky 2 organization Sophos 1 organization Trend Micro 1 product 360 Total Security 1 malware CoolClient 1 product PlugX 1 malware ToneShell 1 organization Nanjing Ranyi Technology Co., Ltd. 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.