Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.
Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.
- Kernel driver msagent.sys is signed with a Nanjing Ranyi Technology certificate.
- CoolClient deploys the driver only with full SCM access and SeTcbPrivilege.
- Rootkit hides processes, files, registry keys, and C2 IPv4 addresses.
- PlugX used as initial post-compromise implant to deliver CoolClient.
- Kaspersky published hashes, paths, and C2 domains as IOCs.
- ATT&CK
- T1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1134.001 Token ManipulationT1055 Process InjectionT1014 Rootkit
- Threat actors
- Mustang PandaHoneyMyte
- Malware
- CoolClientPlugX
- Organizations
- Nanjing Ranyi Technology Co., Ltd.
From the original article
4 min read at thehackernews.com
The threat actor known as HoneyMyte (aka Mustang Panda ) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.