Key Takeaways
- HoneyMyte (also known as Mustang Panda) has deployed an updated CoolClient backdoor that includes a signed Windows kernel‑mode rootkit (msagent.sys) to hide and protect malicious artifacts.
- The rootkit is installed only when CoolClient obtains full access to the Service Control Manager and the SeTcbPrivilege privilege; otherwise the driver deployment is skipped.
- Kaspersky observed infections in government entities across Myanmar, Mongolia, Pakistan, and Russia, with CoolClient typically delivered as a secondary payload after an initial PlugX compromise.
- The signed driver, certified to Nanjing Ranyi Technology Co., Ltd. (valid Aug 2013 – Sep 2014), exposes three IOCTL requests that register trusted processes, convey C2 IP addresses, and protect filesystem/registry paths.
- Beyond stealth, CoolClient retains classic capabilities such as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and extensibility via plugins.
- Indicators of compromise (IOCs) include file hashes for msagent.sys and libngs.dll, specific registry and service names, and known C2 domains.
Overview of HoneyMyte’s Latest Campaign
HoneyMyte, tracked also as Mustang Panda, has been observed using an evolved version of the CoolClient backdoor that incorporates a signed kernel‑mode rootkit. Kaspersky’s analysis reveals that the threat actor targeted governmental organizations in Myanmar, Mongolia, Pakistan, and Russia, deploying CoolClient as a secondary implant following an initial PlugX infection. The addition of the rootkit markedly expands the malware’s ability to conceal its presence on infected Windows systems.
Infection Chain Initiated by PlugX
In the Myanmar‑focused campaign, PlugX served as the first‑stage post‑compromise implant. After gaining a foothold, the attackers used PlugX to drop and execute CoolClient components. To evade detection, they added Microsoft Defender exclusions for a fabricated Windows Defender installation directory and a renamed sideloading executable. The malicious files were placed in a controlled directory where a legitimate Sangfor executable was renamed to defender.exe, enabling DLL sideloading. Persistence was achieved via a scheduled task that launches the binary with SYSTEM privileges at each system startup.
Execution Flow from Sangfor DLL to Final Implant
When the legitimate Sangfor application loads the malicious libngs.dll, it decrypts and executes a second‑stage component named loadcert.ini. This stage handles a variety of tasks: establishing persistence through an AutoRun registry entry (goopdate), creating a Windows service (media_updaten), bypassing User Account Control, performing process injection, and preparing for driver deployment. Ultimately, loadcert.ini loads the final‑stage cert.ini implant, which manages command‑and‑control (C2) communications and provides the core backdoor functionality.
Privilege‑Dependent Driver Deployment
CoolClient attempts to install its kernel‑mode driver only when it possesses full access to the Service Control Manager (SCM) and holds the SeTcbPrivilege privilege. If these conditions are not satisfied, the malware skips the driver installation step and proceeds directly to loading the user‑mode backdoor. This conditional logic ensures that the rootkit is deployed only on hosts where the attacker has attained sufficient administrative rights.
Details of the Signed msagent.sys Rootkit
When privileges are adequate, loadcert.ini extracts an embedded LZMA‑compressed kernel driver, writes it to disk as msagent.sys, and creates and starts a driver service named msagent. The driver bears a digital signature issued to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from August 2013 to September 2014. Kaspersky noted that older malicious drivers signed with the same certificate date back to circa 2013, though no direct link to the current CoolClient activity has been established.
IOCTL‑Based Communication Between User‑Mode and Kernel
Once loaded, msagent.sys receives configuration from the CoolClient user‑mode component via input/output control (IOCTL) requests. During normal execution the malware issues three specific IOCTLs:
- 0x222120 – registers the current CoolClient process as a trusted process with the driver.
- 0x2221E0 – passes the configured C2 IPv4 address to the driver.
- 0x2220F0 – registers filesystem and registry paths that should be protected.
The first IOCTL grants the registered process elevated access to protected files, registry keys, and processes, while the third ensures that the malware’s own installation directory and service registry path are shielded from inspection, modification, or deletion.
Stealth Mechanisms Implemented by the Rootkit
The driver reads its stealth configuration from the registry key \REGISTRY\MACHINE\SYSTEM\RNG, which contains separate entries for directories, files, registry keys/values, and processes that must be hidden, protected, or ignored. msagent.sys registers callbacks for filesystem, registry, process, object, and image‑load events, consulting these entries to enforce its policies. For process protection, the driver reduces the access rights granted when another process attempts to open a handle to a protected process, thereby thwarting termination or code‑injection attempts. In the analyzed sample, the protected process housed CoolClient code injected into synchost.exe.
Additional Kernel‑Level Hiding Techniques
Beyond access‑rights restriction, the rootkit hides processes by unlinking their entries from the Windows active process list. It employs a filesystem minifilter to block access to protected files and directories. A registry callback removes protected keys and values from enumeration results and blocks attempts to modify or delete them. Furthermore, a hook installed in the Nsiproxy driver filters the configured C2 IPv4 addresses from network information returned to user mode, preventing network‑based detection of the malware’s communications.
Extent of IOCTL Functionality in msagent.sys
Kaspersky discovered that msagent.sys implements 33 distinct IOCTL handlers, offering capabilities such as hiding processes and kernel modules, manipulating registry values, and interacting with kernel notification callbacks. However, the analyzed CoolClient sample invoked only the three IOCTLs listed above during its normal operation; the remaining handlers remained unused in this particular deployment.
Indicators of Compromise Provided by Kaspersky
To aid defenders, Kaspersky published several file hashes associated with the threat:
- 2d7c8780e97409770a9d4f31c66c9d63 (msagent.sys)
- 9460E150E1981D5C165043520c5c12fe (msagent.sys)
- 9717f005c5fb98e08d2ad983d88f94ee (libngs.dll)
- F518D8E5FE70D9090F6280C68A95998F (libngs.dll)
These hashes, alongside the known registry entry names (goopdate, media_updaten), service name (msagent), and observed C2 domains, constitute actionable IOCs for detection and hunting efforts.
Context Within HoneyMyte’s Evolving Toolset
The appearance of this signed rootkit follows a disclosure from six months earlier, in which Kaspersky reported a newer CoolClient variant that dropped a previously unseen rootkit during campaigns against Pakistan and Myanmar (January 2026). Additionally, in December 2025 the vendor documented a distinct HoneyMyte kernel‑mode rootkit used to load the ToneShell backdoor. The design of the current msagent.sys driver parallels the kernel‑mode enhancements seen with ToneShell, although CoolClient distinguishes itself by exposing dedicated IOCTL handlers for direct communication with its user‑mode backdoor, thereby tightening the integration between the two layers.