> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - URL: https://f4n6.co.uk/security-feed/apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kernel-level-windows-rootkit/ - Published: 2026-08-14T12:18:33.000Z - Updated: 2026-08-14T12:18:33.000Z - Author: Jeff Davies - Tags: #security-feed, HoneyMyte, Mustang Panda ## 1\. Executive summary The HoneyMyte APT group (also associated with the MITRE-confirmed actor Mustang Panda, G0129) has significantly upgraded the CoolClient backdoor with a signed kernel-mode Windows rootkit (`msagent.sys`). The rootkit provides stealth by hiding processes, files, and registry keys via filesystem minifilter and registry callbacks, and filters network telemetry by hooking the Nsiproxy driver. Observed victims include government entities in Myanmar, Mongolia, Pakistan, and Russia, with PlugX used as the initial implant prior to CoolClient deployment. EMEA financial services with exposure to Asian markets or supply chains should treat this as a high-severity espionage threat, as the kernel-level interference severely degrades standard EDR and forensic capabilities. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | The rootkit (msagent.sys) hides processes and network connections by hooking Nsiproxy and using filesystem minifilters, bypassing standard EDR visibility. | Financial entities must validate that their resilience testing explicitly includes kernel-level rootkit detection and assume user-mode telemetry blind spots during red-team exercises. | ## 3\. Technical analysis & attack chain **Attribution caveat:** The source attributes this activity to "HoneyMyte" and states it is "also known as Mustang Panda." Per verified reference data, Mustang Panda is MITRE G0129\. However, "HoneyMyte" has no MITRE ATT&CK profile; this specific alias attribution is therefore treated as unconfirmed. The confirmed attack chain proceeds as follows: 1. **Initial Access & Staging:** HoneyMyte deploys PlugX as the initial post-compromise implant. The actor creates a fake Windows Defender directory (`C:\Program Files\Microsoft\Windows Defender\`) and copies CoolClient components into it. A legitimate Sangfor executable (`Sang.exe`) is renamed to `defender.exe` to act as a DLL sideloader. 2. **Defense Evasion:** Before deployment, Microsoft Defender exclusions are added via `wmic` for the fake directory and `defender.exe`. 3. **Persistence:** A scheduled task is created to launch `defender.exe` with SYSTEM privileges at system startup: `schtasks /create /sc onstart /tn "\Microsoft\Windows\Windows Defender Advanced Threat Protection Service" /tr "\"$programfiles\Microsoft\Windows Defender\defender.exe\"" /ru "system" /F` 4. **Execution (DLL Sideloading):** `defender.exe` sideloads the malicious `libngs.dll`. The DLL uses dummy exports calling `OutputDebugStringA` and `ExitProcess` to appear legitimate, while `DllMain` executes the malicious loader. 5. **First Stage Decryption:** `libngs.dll` decrypts `loadcert.ini` using a 0x32-byte repeating XOR keystream derived from a transformed seed value of `0xA4` and loads it into memory. 6. **Second Stage Execution (`loadcert.ini`):** If running in the original sideloaded process, it establishes an AutoRun registry key (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, value `goopdate`) to launch `Sang.exe` with the `work` parameter. It also installs a Windows service named `media_updaten` (if 360 Total Security is not detected) and performs a UAC bypass using an RPC-based process creation technique (PPID spoofing via `computerdefaults.exe` and `winver.exe`). 7. **Process Injection:** `loadcert.ini` decrypts itself (using a 0x32-byte XOR keystream from base key `0x4D`) and injects into a suspended `synchost.exe` process. 8. **Rootkit Deployment:** Inside `synchost.exe`, the malware extracts an LZMA-compressed driver from `loadcert.ini`, writes it to `C:\Program Files\Microsoft\Windows Defender\msagent.sys`, and creates a driver service named `msagent`. 9. **Rootkit Initialization:** The user-mode component opens `\\.\msagent` and issues three IOCTLs: - `0x222120`: Registers the CoolClient process as trusted. - `0x2221E0`: Sends the C2 IPv4 address to the driver. - `0x2220F0`: Registers filesystem and registry paths for protection (e.g., the installation directory and `\Registry\Machine\SYSTEM\CurrentControlSet\Services\media_updaten`). 10. **Final Stage Implant:** The malware decrypts `cert.ini` (the final-stage backdoor) and injects it into a new `synchost.exe` process using `CreateProcessAsUserA`. ### Kernel-Mode Driver (`msagent.sys`) Capabilities - **Signing:** Digitally signed by "Nanjing Ranyi Technology Co., Ltd." (Serial: `3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD`, valid Aug 2013 – Sep 2014). Contains PDB path: `E:\work\南京实验室\2024项目\张雪杰云南m\研发\FTool\Tool\x64\Release\FTool.pdb`. - **Configuration:** Loads stealth configuration from `\REGISTRY\MACHINE\SYSTEM\RNG`. Uses `REG_DWORD` values `Hid_State` (1) and `Hid_StealthMode` (0), and `REG_MULTI_SZ` values `Wid_H1deF5Dirs`, `Wid_H1deF5Files`, `Wid_H1deRegKeys`, `Wid_H1deRegValues`, `Hid_IgnoredImages`, `Hid_ProtectedImages`. - **Process Hiding:** Dynamically locates `ActiveProcessLinks` in `EPROCESS` and unlinks entries via IOCTLs `0x22219C` (hide) and `0x2221A0` (restore). - **File/Registry Protection:** Registers a filesystem minifilter (dynamically assigned altitude) and a registry callback via `CmRegisterCallbackEx` (altitude 320000). Denies access to protected paths and returns `STATUS_ACCESS_DENIED` for direct registry manipulation. - **Network Filtering:** Hooks the `Nsiproxy` driver by replacing a handler pointer via `ObReferenceObjectByName`. Filters out C2 IP addresses from network data returned to user mode. - **Kernel Module Hiding:** Resolves `PsLoadedModuleList` via `MmGetSystemRoutineAddress` and unlinks modules (IOCTL `0x222138`). - **Advanced IOCTLs:** Implements 33 IOCTL handlers, including shellcode injection (`0x222134`), PPL protection removal (`0x222194`), and arbitrary kernel address writes (`0x2221BC`). ## 4\. Mitigation & containment ### P1 (Within 24h) - **Block Malicious Driver:** Add the `msagent.sys` file hashes (MD5: `2d7c8780e97409770a9d4f31c66c9d63`) to EDR blocklists. If using Microsoft Defender for Endpoint, utilize attack surface reduction (ASR) rules to block unsigned or vulnerable drivers, though note this driver is signed (albeit with an expired/old certificate). - **Hunt for Persistence:** Search endpoints for the scheduled task name `\Microsoft\Windows\Windows Defender Advanced Threat Protection Service` and the service name `media_updaten`. Remove if found. - **Isolate Compromised Hosts:** If `msagent.sys` or the fake `C:\Program Files\Microsoft\Windows Defender\` directory is detected, isolate the host immediately. Standard EDR removal may fail due to rootkit protections; offline scanning or re-imaging is required. ### P2 (Within 72h) - **Registry Audit:** Hunt for the `goopdate` value under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and the `\REGISTRY\MACHINE\SYSTEM\RNG` key structure (specifically `Wid_H1deF5Dirs`, `Hid_State`). - **Process Monitoring:** Alert on `synchost.exe` spawning from `defender.exe` or `Sang.exe`, and `winver.exe` or `computerdefaults.exe` spawning `Sang.exe`. - **Network Defences:** Block the identified C2 domains at the firewall/proxy. Note that the rootkit hides C2 IPs from local `Nsiproxy` queries, so network-level detection is critical. ### P3 (Within 7 days) - **Defender Exclusion Audit:** Review Microsoft Defender exclusion policies across the estate for unauthorized entries pointing to `C:\Program Files\Microsoft\Windows Defender\` or specific executables named `defender.exe`. - **DLL Sideloading Mitigations:** Enable Microsoft Defender for Endpoint's protection against DLL sideloading (e.g., enabling `MandatoryASLR` and validating Sangfor executable usage). ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ------------------------------------------------------------- | ---------- | ---------- | | md5 | 2d7c8780e97409770a9d4f31c66c9d63 | High | Securelist | | md5 | 9460E150E1981D5C165043520C5C12FE | High | Securelist | | md5 | 9717F005C5FB98E08D2AD983D88F94EE | High | Securelist | | md5 | F518D8E5FE70D9090F6280C68A95998F | High | Securelist | | md5 | EB79558B037669792652A816E2C669DE | High | Securelist | | filepath | C:\\Program Files\\microsoft\\windows defender\\ | High | Securelist | | filepath | C:\\Program Files\\windows media player\\mediares\\ | High | Securelist | | filepath | C:\\ProgramData\\symantecdir\\ | High | Securelist | | filepath | C:\\ProgramData\\virtualstore\\ | High | Securelist | | filepath | C:\\Windows\\identitycrl\\production\\ | High | Securelist | | filepath | C:\\Windows\\serviceprofiles\\networkservice\\ | High | Securelist | | filepath | C:\\Users\\\\AppData\\Local\\viber24.8\\ | High | Securelist | | filepath | C:\\Users\\\\AppData\\Roaming\\dsassistant\\ | High | Securelist | | filepath | C:\\Program Files\\common files\\microsoft shared\\office14\\ | High | Securelist | | filepath | C:\\programdata\\msdn\\ | High | Securelist | | domain | cloudtroe.giize\[.\]com | High | Securelist | | domain | employers.theworkpc\[.\]com | High | Securelist | | domain | freeread.casacam\[.\]net | High | Securelist | | domain | us.lenovoappstore\[.\]com | High | Securelist | | domain | sundanish.freeddns\[.\]org | High | Securelist | | domain | torinarlabs.webredirect\[.\]org | High | Securelist | | domain | news.dursamjbataar\[.\]org | High | Securelist | | domain | video.dursamjbataar\[.\]org | High | Securelist | | domain | black-popular\[.\]com | High | Securelist | | domain | whatismybestthing\[.\]com | High | Securelist | ```iocs md5 2d7c8780e97409770a9d4f31c66c9d63 md5 9460E150E1981D5C165043520C5C12FE md5 9717F005C5FB98E08D2AD983D88F94EE md5 F518D8E5FE70D9090F6280C68A95998F md5 EB79558B037669792652A816E2C669DE filepath C:\Program Files\microsoft\windows defender\ filepath C:\Program Files\windows media player\mediares\ filepath C:\ProgramData\symantecdir\ filepath C:\ProgramData\virtualstore\ filepath C:\Windows\identitycrl\production\ filepath C:\Windows\serviceprofiles\networkservice\ filepath C:\Users\\AppData\Local\viber24.8\ filepath C:\Users\\AppData\Roaming\dsassistant\ filepath C:\Program Files\common files\microsoft shared\office14\ filepath C:\programdata\msdn\ domain cloudtroe.giize[.]com domain employers.theworkpc[.]com domain freeread.casacam[.]net domain us.lenovoappstore[.]com domain sundanish.freeddns[.]org domain torinarlabs.webredirect[.]org domain news.dursamjbataar[.]org domain video.dursamjbataar[.]org domain black-popular[.]com domain whatismybestthing[.]com ``` ## 6\. Detection ```yara rule CoolClient_Rootkit_msagent_sys { meta: author = "Adverse Trace" date = "2026-08-14" reference = "https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/" description = "Detects the CoolClient kernel-mode driver msagent.sys based on PDB path and IOCTL device names" strings: $pdb = "E:\\work\\南京实验室\\2024项目\\张雪杰云南m\\研发\\FTool\\Tool\\x64\\Release\\FTool.pdb" ascii $dev_obj = "\\Device\\ToolTool" ascii wide $sym_link = "\\DosDevices\\ToolTool" ascii wide $reg_config = "\\REGISTRY\\MACHINE\\SYSTEM\\RNG" ascii wide $reg_val_1 = "Wid_H1deF5Dirs" ascii wide $reg_val_2 = "Hid_ProtectedImages" ascii wide $reg_val_3 = "Hid_StealthMode" ascii wide condition: uint16(0) == 0x5a4d and 4 of them } rule CoolClient_Loader_libngs_dll { meta: author = "Adverse Trace" date = "2026-08-14" reference = "https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/" description = "Detects the CoolClient first-stage loader libngs.dll based on encrypted payload filenames" strings: $stage2 = "loadcert.ini" ascii wide $config = "time.ini" ascii wide $stage3 = "cert.ini" ascii wide condition: uint16(0) == 0x5a4d and 2 of them } ``` ```yaml title: Detect CoolClient Persistence and Execution Chain id: 7a9c1f2d-4b5e-4a8c-9f1a-6d7e8f9a0b1c status: experimental description: Detects scheduled task creation, service creation, and auturun keys associated with CoolClient deployment author: Adverse Trace date: 2026/08/14 references: - https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/ logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: '\schtasks.exe' CommandLine|contains|all: - '/create' - '/sc onstart' - '\Microsoft\Windows\Windows Defender Advanced Threat Protection Service' - 'defender.exe' selection_sc: Image|endswith: '\sc.exe' CommandLine|contains: 'start media_updaten' selection_wmic: Image|endswith: '\wmic.exe' CommandLine|contains|all: - 'MSFT_MpPreference' - 'Add ExclusionPath' condition: selection_schtasks or selection_sc or selection_wmic fields: - CommandLine - ParentImage falsepositives: - Legitimate administrator activity (unlikely for this specific combination) level: high ``` ## Threat actor context **Mustang Panda** · [G0129](https://attack.mitre.org/groups/G0129?ref=f4n6.co.uk) · aka TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT [Mustang Panda](https://attack.mitre.org/groups/G0129?ref=f4n6.co.uk) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012\. [Mustang Panda](https://attack.mitre.org/groups/G0129?ref=f4n6.co.uk) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. … *No MITRE ATT&CK profile for: HoneyMyte.* ## 7\. Sources - **Securelist**, "APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit", https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/, 2026-08-14 ## 8\. Adverse Trace position This advisory reflects a high-severity threat to EMEA financial services, particularly those with operations, supply chains, or strategic interests in Asia. The introduction of a signed kernel-mode rootkit (`msagent.sys`) by HoneyMyte (unconfirmed MITRE alias; Mustang Panda is G0129) significantly raises the detection difficulty, as the malware can actively hide its processes, files, and network connections from standard security tooling. The use of an expired but trusted certificate for signing and the abuse of legitimate Sangfor binaries for sideloading are standard but effective techniques. We assess that standard EDR solutions may be blinded on compromised hosts; network-level monitoring and proactive hunting for the specific persistence mechanisms (scheduled task name, `media_updaten` service) are critical. Adverse Trace will continue to monitor for the expansion of this toolset into EMEA regions and update clients on any confirmed infrastructure overlap. --- [Read the original source →](https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*