Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The China-linked threat actor HoneyMyte, also known as Mustang Panda, has been observed using an updated version of the CoolClient backdoor alongside a signed Windows kernel-mode rootkit.

According to Kaspersky research, the campaign has targeted organizations in Myanmar, Mongolia, Pakistan and Russia, including confirmed government entities.

The latest CoolClient variant introduces a previously undocumented kernel driver named msagent.sys, significantly expanding the malware's stealth and defense-evasion capabilities.

Key Highlights

• Threat actor: HoneyMyte / Mustang Panda
• Primary malware: CoolClient
• Kernel rootkit: msagent.sys
• Initial post-compromise implant: PlugX
• Targets include government organizations.
• Victims identified in Myanmar, Mongolia, Pakistan and Russia.
• Rootkit hides processes, files, registry objects and C2 information.
• Driver is installed as a Windows service named msagent.
• CoolClient supports keylogging, clipboard theft and credential harvesting.
• Malware uses DLL sideloading through a legitimate Sangfor executable.
• Persistence includes scheduled tasks, registry Run keys and Windows services.
• The rootkit communicates with CoolClient through IOCTL requests.
• The driver uses filesystem, registry, process and image-load callbacks.

Attack Chain

The observed campaign uses PlugX as the initial post-compromise implant.

The attack chain can be summarized as:

PlugX → CoolClient Components → DLL Sideloading → Persistence → Process Injection → msagent.sys Rootkit → C2

In one Myanmar campaign, the attackers created a fake Windows Defender directory and added a Microsoft Defender exclusion.

A legitimate Sangfor executable was renamed to:

defender.exe

The malicious libngs.dll was then loaded through DLL sideloading.

CoolClient Backdoor

CoolClient acts as the user-mode backdoor and provides several capabilities, including:

• Keylogging
• Clipboard theft
• Credential harvesting
• File management
• System reconnaissance
• Plugin-based functionality
• Command-and-control communication

The malware can also inject its code into a process named:

synchost.exe

This provides the attacker with a legitimate-looking process context for subsequent activity.

Persistence

The malware establishes multiple persistence mechanisms.

Observed mechanisms include:

• Scheduled task execution
• Registry AutoRun entries
• Windows services
• Process injection

A scheduled task can launch the malware with SYSTEM privileges during system startup.

The malware also creates an AutoRun registry entry named:

goopdate

and can create a Windows service named:

media_updaten

Process Injection and PPID Spoofing

The second-stage component uses an RPC-based process-creation technique combined with parent process ID (PPID) spoofing.

This allows the malware to relaunch itself in an elevated context before injecting its code into:

synchost.exe

The technique helps the malware blend malicious activity into legitimate Windows processes and complicates process-tree analysis.

Signed Kernel Rootkit

When sufficient privileges are available, the malware extracts an embedded LZMA-compressed driver and writes it to disk as:

msagent.sys

It then creates and starts a Windows driver service named:

msagent

The driver is digitally signed using a certificate issued to Nanjing Ranyi Technology Co., Ltd., which was valid between August 2013 and September 2014.

Kaspersky also identified older malicious drivers signed with the same certificate, although it did not establish a direct connection between those samples and the current CoolClient campaign.

Kernel-Level Stealth

The msagent.sys driver significantly increases CoolClient's ability to hide from security tools.

The rootkit can:

• Hide processes
• Hide kernel modules
• Hide files and directories
• Hide registry keys and values
• Protect malicious processes from termination
• Prevent code injection into protected processes
• Filter C2 IP addresses from network information
• Protect malicious files from modification or deletion

The rootkit maintains its configuration under:

HKLM\SYSTEM\RNG

It uses separate configuration entries for protected processes, files, directories and registry objects.

IOCTL Communication

CoolClient communicates with the kernel driver through IOCTL requests.

Three IOCTLs were observed during normal execution:

• 0x222120 — Registers the CoolClient process as trusted.
• 0x2221E0 — Passes the configured C2 IPv4 address to the driver.
• 0x2220F0 — Registers filesystem and registry paths to protect.

The driver contains 33 IOCTL handlers, although only three were observed being used by the analyzed sample during normal operation.

Process Hiding

The rootkit can remove protected processes from the Windows active process list.

This can prevent conventional process enumeration tools from displaying the malicious process.

It can also restrict access to protected processes, making it more difficult for security software or administrators to terminate or inspect the implant.

Filesystem and Registry Hiding

The driver uses a filesystem minifilter to restrict access to protected files and directories.

A registry callback can:

• Remove protected registry keys from enumeration
• Remove protected values from enumeration
• Block modification attempts
• Block deletion attempts

This allows the malware to maintain persistence while reducing its visibility to defenders.

C2 Concealment

The rootkit also hooks the Windows Nsiproxy driver.

This functionality filters configured C2 IPv4 addresses from network information returned to user-mode applications.

As a result, the malware can attempt to hide its network infrastructure from standard Windows network inspection utilities.

Detection and Hunting Opportunities

Security teams should monitor for:

• Creation of unexpected kernel-mode driver services
• msagent.sys
• Service named msagent
• Unexpected driver installation
• Old or suspicious digital certificates used to sign drivers
• libngs.dll DLL sideloading
• Unexpected Sangfor executable copies
• Files named loadcert.ini and cert.ini
• Registry Run value goopdate
• Service media_updaten
• Suspicious scheduled tasks launching at system startup
• Process injection into synchost.exe
• PPID spoofing
• Microsoft Defender exclusions added to unusual directories
• Unexpected PlugX activity
• Keylogging behavior
• Suspicious clipboard access
• Unauthorized credential harvesting
• Hidden processes or files
• Suspicious IOCTL communication with kernel drivers
• Unusual outbound C2 traffic

Recommended Mitigations

1. Monitor and restrict installation of unsigned or suspicious kernel drivers.
2. Enable Windows driver-security controls such as vulnerable-driver blocking where supported.
3. Monitor creation of new Windows services.
4. Monitor scheduled-task creation and modification.
5. Audit Microsoft Defender exclusions.
6. Detect DLL sideloading involving trusted applications.
7. Monitor PPID spoofing and suspicious process injection.
8. Investigate unusual kernel drivers even when they are digitally signed.
9. Monitor registry Run-key modifications.
10. Hunt for msagent.sys, loadcert.ini, cert.ini and libngs.dll.
11. Review endpoints for PlugX and CoolClient activity.
12. Monitor suspicious credential and clipboard access.
13. Apply endpoint protections capable of detecting rootkit behavior.
14. Investigate systems where kernel-level stealth or process hiding is suspected.

Threat Assessment

The use of a signed kernel-mode rootkit substantially increases the severity of the CoolClient campaign.

Kernel-level access allows the attacker to operate below many traditional endpoint-security mechanisms and hide critical components of the infection.

The combination of PlugX, CoolClient, DLL sideloading, process injection, persistence and kernel-level stealth demonstrates a mature post-compromise capability associated with HoneyMyte.

Indicators of Compromise

• 2d7c8780e97409770a9d4f31c66c9d63 — msagent.sys
• 9460E150E1981D5C165043520c5c12fe — msagent.sys
• 9717f005c5fb98e08d2ad983d88f94ee — libngs.dll
• F518D8E5FE70D9090F6280C68A95998F — libngs.dll
• msagent.sys — Kernel driver
• msagent — Driver service
• loadcert.ini — Second-stage component
• cert.ini — Final-stage implant
• libngs.dll — Malicious sideloaded DLL
• goopdate — Registry AutoRun value
• media_updaten — Windows service
• synchost.exe — Injection target
• \REGISTRY\MACHINE\SYSTEM\RNG — Rootkit configuration location
• 0x222120 — CoolClient IOCTL
• 0x2221E0 — C2 configuration IOCTL
• 0x2220F0 — Protected path configuration IOCTL

Conclusion

Organizations should not assume that a digitally signed Windows driver is automatically trustworthy.

Security teams should specifically monitor for suspicious driver installation, unexpected service creation, driver certificates with unusual historical context, process hiding, DLL sideloading and Microsoft Defender exclusion changes.

Systems suspected of running the CoolClient rootkit should be isolated and investigated using offline or trusted forensic tooling because kernel-level rootkits can interfere with normal endpoint visibility.