APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

1. Executive summary

The HoneyMyte APT group (also associated with the MITRE-confirmed actor Mustang Panda, G0129) has significantly upgraded the CoolClient backdoor with a signed kernel-mode Windows rootkit (msagent.sys). The rootkit provides stealth by hiding processes, files, and registry keys via filesystem minifilter and registry callbacks, and filters network telemetry by hooking the Nsiproxy driver. Observed victims include government entities in Myanmar, Mongolia, Pakistan, and Russia, with PlugX used as the initial implant prior to CoolClient deployment. EMEA financial services with exposure to Asian markets or supply chains should treat this as a high-severity espionage threat, as the kernel-level interference severely degrades standard EDR and forensic capabilities.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: The source attributes this activity to "HoneyMyte" and states it is "also known as Mustang Panda." Per verified reference data, Mustang Panda is MITRE G0129. However, "HoneyMyte" has no MITRE ATT&CK profile; this specific alias attribution is therefore treated as unconfirmed.

The confirmed attack chain proceeds as follows:

1. Initial Access & Staging: HoneyMyte deploys PlugX as the initial post-compromise implant. The actor creates a fake Windows Defender directory (C:\Program Files\Microsoft\Windows Defender\) and copies CoolClient components into it. A legitimate Sangfor executable (Sang.exe) is renamed to defender.exe to act as a DLL sideloader.
2. Defense Evasion: Before deployment, Microsoft Defender exclusions are added via wmic for the fake directory and defender.exe.
3. Persistence: A scheduled task is created to launch defender.exe with SYSTEM privileges at system startup: schtasks /create /sc onstart /tn "\Microsoft\Windows\Windows Defender Advanced Threat Protection Service" /tr "\"$programfiles\Microsoft\Windows Defender\defender.exe\"" /ru "system" /F
4. Execution (DLL Sideloading): defender.exe sideloads the malicious libngs.dll. The DLL uses dummy exports calling OutputDebugStringA and ExitProcess to appear legitimate, while DllMain executes the malicious loader.
5. First Stage Decryption: libngs.dll decrypts loadcert.ini using a 0x32-byte repeating XOR keystream derived from a transformed seed value of 0xA4 and loads it into memory.
6. Second Stage Execution (loadcert.ini): If running in the original sideloaded process, it establishes an AutoRun registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run, value goopdate) to launch Sang.exe with the work parameter. It also installs a Windows service named media_updaten (if 360 Total Security is not detected) and performs a UAC bypass using an RPC-based process creation technique (PPID spoofing via computerdefaults.exe and winver.exe).
7. Process Injection: loadcert.ini decrypts itself (using a 0x32-byte XOR keystream from base key 0x4D) and injects into a suspended synchost.exe process.
8. Rootkit Deployment: Inside synchost.exe, the malware extracts an LZMA-compressed driver from loadcert.ini, writes it to C:\Program Files\Microsoft\Windows Defender\msagent.sys, and creates a driver service named msagent.
9. Rootkit Initialization: The user-mode component opens \\.\msagent and issues three IOCTLs:
   • 0x222120: Registers the CoolClient process as trusted.
   • 0x2221E0: Sends the C2 IPv4 address to the driver.
   • 0x2220F0: Registers filesystem and registry paths for protection (e.g., the installation directory and \Registry\Machine\SYSTEM\CurrentControlSet\Services\media_updaten).
10. Final Stage Implant: The malware decrypts cert.ini (the final-stage backdoor) and injects it into a new synchost.exe process using CreateProcessAsUserA.

Kernel-Mode Driver (msagent.sys) Capabilities

• Signing: Digitally signed by "Nanjing Ranyi Technology Co., Ltd." (Serial: 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD, valid Aug 2013 – Sep 2014). Contains PDB path: E:\work\南京实验室\2024项目\张雪杰云南m\研发\FTool\Tool\x64\Release\FTool.pdb.
• Configuration: Loads stealth configuration from \REGISTRY\MACHINE\SYSTEM\RNG. Uses REG_DWORD values Hid_State (1) and Hid_StealthMode (0), and REG_MULTI_SZ values Wid_H1deF5Dirs, Wid_H1deF5Files, Wid_H1deRegKeys, Wid_H1deRegValues, Hid_IgnoredImages, Hid_ProtectedImages.
• Process Hiding: Dynamically locates ActiveProcessLinks in EPROCESS and unlinks entries via IOCTLs 0x22219C (hide) and 0x2221A0 (restore).
• File/Registry Protection: Registers a filesystem minifilter (dynamically assigned altitude) and a registry callback via CmRegisterCallbackEx (altitude 320000). Denies access to protected paths and returns STATUS_ACCESS_DENIED for direct registry manipulation.
• Network Filtering: Hooks the Nsiproxy driver by replacing a handler pointer via ObReferenceObjectByName. Filters out C2 IP addresses from network data returned to user mode.
• Kernel Module Hiding: Resolves PsLoadedModuleList via MmGetSystemRoutineAddress and unlinks modules (IOCTL 0x222138).
• Advanced IOCTLs: Implements 33 IOCTL handlers, including shellcode injection (0x222134), PPL protection removal (0x222194), and arbitrary kernel address writes (0x2221BC).

4. Mitigation & containment

P1 (Within 24h)

• Block Malicious Driver: Add the msagent.sys file hashes (MD5: 2d7c8780e97409770a9d4f31c66c9d63) to EDR blocklists. If using Microsoft Defender for Endpoint, utilize attack surface reduction (ASR) rules to block unsigned or vulnerable drivers, though note this driver is signed (albeit with an expired/old certificate).
• Hunt for Persistence: Search endpoints for the scheduled task name \Microsoft\Windows\Windows Defender Advanced Threat Protection Service and the service name media_updaten. Remove if found.
• Isolate Compromised Hosts: If msagent.sys or the fake C:\Program Files\Microsoft\Windows Defender\ directory is detected, isolate the host immediately. Standard EDR removal may fail due to rootkit protections; offline scanning or re-imaging is required.

P2 (Within 72h)

• Registry Audit: Hunt for the goopdate value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the \REGISTRY\MACHINE\SYSTEM\RNG key structure (specifically Wid_H1deF5Dirs, Hid_State).
• Process Monitoring: Alert on synchost.exe spawning from defender.exe or Sang.exe, and winver.exe or computerdefaults.exe spawning Sang.exe.
• Network Defences: Block the identified C2 domains at the firewall/proxy. Note that the rootkit hides C2 IPs from local Nsiproxy queries, so network-level detection is critical.

P3 (Within 7 days)

• Defender Exclusion Audit: Review Microsoft Defender exclusion policies across the estate for unauthorized entries pointing to C:\Program Files\Microsoft\Windows Defender\ or specific executables named defender.exe.
• DLL Sideloading Mitigations: Enable Microsoft Defender for Endpoint's protection against DLL sideloading (e.g., enabling MandatoryASLR and validating Sangfor executable usage).

5. Indicators of compromise

md5  2d7c8780e97409770a9d4f31c66c9d63
md5  9460E150E1981D5C165043520C5C12FE
md5  9717F005C5FB98E08D2AD983D88F94EE
md5  F518D8E5FE70D9090F6280C68A95998F
md5  EB79558B037669792652A816E2C669DE
filepath  C:\Program Files\microsoft\windows defender\
filepath  C:\Program Files\windows media player\mediares\
filepath  C:\ProgramData\symantecdir\
filepath  C:\ProgramData\virtualstore\
filepath  C:\Windows\identitycrl\production\
filepath  C:\Windows\serviceprofiles\networkservice\
filepath  C:\Users\<user>\AppData\Local\viber24.8\
filepath  C:\Users\<user>\AppData\Roaming\dsassistant\
filepath  C:\Program Files\common files\microsoft shared\office14\
filepath  C:\programdata\msdn\
domain  cloudtroe.giize[.]com
domain  employers.theworkpc[.]com
domain  freeread.casacam[.]net
domain  us.lenovoappstore[.]com
domain  sundanish.freeddns[.]org
domain  torinarlabs.webredirect[.]org
domain  news.dursamjbataar[.]org
domain  video.dursamjbataar[.]org
domain  black-popular[.]com
domain  whatismybestthing[.]com

6. Detection

rule CoolClient_Rootkit_msagent_sys {
    meta:
        author = "Adverse Trace"
        date = "2026-08-14"
        reference = "https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/"
        description = "Detects the CoolClient kernel-mode driver msagent.sys based on PDB path and IOCTL device names"
    strings:
        $pdb = "E:\\work\\南京实验室\\2024项目\\张雪杰云南m\\研发\\FTool\\Tool\\x64\\Release\\FTool.pdb" ascii
        $dev_obj = "\\Device\\ToolTool" ascii wide
        $sym_link = "\\DosDevices\\ToolTool" ascii wide
        $reg_config = "\\REGISTRY\\MACHINE\\SYSTEM\\RNG" ascii wide
        $reg_val_1 = "Wid_H1deF5Dirs" ascii wide
        $reg_val_2 = "Hid_ProtectedImages" ascii wide
        $reg_val_3 = "Hid_StealthMode" ascii wide
    condition:
        uint16(0) == 0x5a4d and 4 of them
}

rule CoolClient_Loader_libngs_dll {
    meta:
        author = "Adverse Trace"
        date = "2026-08-14"
        reference = "https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/"
        description = "Detects the CoolClient first-stage loader libngs.dll based on encrypted payload filenames"
    strings:
        $stage2 = "loadcert.ini" ascii wide
        $config = "time.ini" ascii wide
        $stage3 = "cert.ini" ascii wide
    condition:
        uint16(0) == 0x5a4d and 2 of them
}

title: Detect CoolClient Persistence and Execution Chain
id: 7a9c1f2d-4b5e-4a8c-9f1a-6d7e8f9a0b1c
status: experimental
description: Detects scheduled task creation, service creation, and auturun keys associated with CoolClient deployment
author: Adverse Trace
date: 2026/08/14
references:

    - https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/
logsource:
    product: windows
    category: process_creation
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:

            - '/create'
            - '/sc onstart'
            - '\Microsoft\Windows\Windows Defender Advanced Threat Protection Service'
            - 'defender.exe'
    selection_sc:
        Image|endswith: '\sc.exe'
        CommandLine|contains: 'start media_updaten'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:

            - 'MSFT_MpPreference'
            - 'Add ExclusionPath'
    condition: selection_schtasks or selection_sc or selection_wmic
fields:

    - CommandLine
    - ParentImage
falsepositives:

    - Legitimate administrator activity (unlikely for this specific combination)
level: high

Threat actor context

Mustang Panda · G0129 · aka TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. …

No MITRE ATT&CK profile for: HoneyMyte.

7. Sources

• Securelist, "APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit", https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/, 2026-08-14

8. Adverse Trace position

This advisory reflects a high-severity threat to EMEA financial services, particularly those with operations, supply chains, or strategic interests in Asia. The introduction of a signed kernel-mode rootkit (msagent.sys) by HoneyMyte (unconfirmed MITRE alias; Mustang Panda is G0129) significantly raises the detection difficulty, as the malware can actively hide its processes, files, and network connections from standard security tooling. The use of an expired but trusted certificate for signing and the abuse of legitimate Sangfor binaries for sideloading are standard but effective techniques. We assess that standard EDR solutions may be blinded on compromised hosts; network-level monitoring and proactive hunting for the specific persistence mechanisms (scheduled task name, media_updaten service) are critical. Adverse Trace will continue to monitor for the expansion of this toolset into EMEA regions and update clients on any confirmed infrastructure overlap.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.