Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.
- Signed kernel driver hides processes, files, registry keys and kernel modules via IOCTL handlers (33 total)
- Deployed after PlugX in Myanmar; victims span Pakistan, Mongolia, Myanmar, Russia and government entities
- Uses fake Windows Defender directory, Sangfor defender.exe sideloading and scheduled task persistence
- Builds on 2022/2025 variants that added keylogging, clipboard theft and credential harvesting
- ATT&CK
- T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1574.002 DLL Side-LoadingT1562.001 Impair Defenses: Disable or Modify ToolsT1543.003 Windows Service
- Threat actors
- Mustang PandaHoneyMyte
- Organizations
- SophosTrend Micro
From the original article
6 min read at securityaffairs.com
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.