HoneyMyte’s CoolClient Backdoor Adds Signed Kernel Rootkit Driver
The threat group HoneyMyte, also tracked as Mustang Panda, has begun deploying an updated version of its CoolClient backdoor alongside a signed Windows kernel-level driver. Kaspersky’s Securelist team documented the campaign in detail, revealing that the driver conceals malicious processes, files, registry keys, and command-server connection data, while also preventing other software from deleting or modifying protected components. Infected systems were identified in Myanmar, Mongolia, Pakistan, and Russia, including within government organizations. In the attacks examined, CoolClient was launched following an initial compromise delivered through PlugX.
CoolClient’s Core Capabilities
CoolClient is capable of capturing keystrokes, copying clipboard contents, stealing credentials, managing files, and gathering system information. Additional capabilities are loaded dynamically through plugins. The new version introduces an additional layer of protection: a dedicated driver operating within the Windows kernel, granting access to mechanisms unreachable by an ordinary user-level program.
Privilege Requirements for Driver Installation
The driver installs only when sufficient privileges are available. CoolClient checks for full access to the Windows Service Control Manager as well as possession of the SeTcbPrivilege right. Windows classifies SeTcbPrivilege as a sensitive system-level permission – a process holding it can effectively act as part of the operating system itself. If the required privileges are absent, the malware skips driver installation entirely and proceeds directly to launching the backdoor’s final-stage component.
Initial Infection Chain: PlugX and DLL Sideloading
In one documented attack against an organization in Myanmar, the attackers first deployed PlugX. Through it, exclusions were added to Microsoft Defender for a fraudulent Windows Defender directory and a renamed executable. Once that directory was prepared, the CoolClient components were copied into it.
Execution relied on a legitimate Sangfor application renamed to defender.exe. Alongside it, the attackers placed a malicious library named libngs.dll. Upon launch, the Sangfor executable loaded the library from its own directory, causing the attackers’ code to execute in place of the legitimate component. This technique is known as DLL sideloading.
The Multi-Stage Loader: loadcert.ini and cert.ini
libngs.dll decrypts the next-stage component, loadcert.ini, and transfers execution to it. Despite its .ini extension, this file contains executable malicious code rather than ordinary configuration settings. loadcert.ini establishes persistence for CoolClient, modifies the registry, bypasses Windows User Account Control, injects code into other processes, installs the kernel driver, and launches the final-stage component, cert.ini. This final component handles communication with command-and-control servers and carries out the backdoor’s core functionality.
For automatic execution on startup, loadcert.ini creates a registry autorun entry named goopdate. The malware is also capable of registering a Windows service under the name media_updaten. Before injecting code, CoolClient attempts to escalate its own privileges and relaunch itself within a more advantageous system context.
Privilege Escalation via PPID Spoofing
To accomplish this, CoolClient uses Remote Procedure Call (RPC) alongside Parent Process ID (PPID) spoofing. Windows tracks which process launched another process. CoolClient falsifies this data so that the newly spawned process appears to be the child of a different, legitimate program. Once running with elevated privileges, the malware injects its code into the synchost.exe process.
Deploying msagent.sys: The Kernel Driver
When the system provides the necessary privileges, loadcert.ini extracts a kernel driver – compressed using the LZMA algorithm – from its own body. The file is saved under the name msagent.sys. CoolClient then creates a driver service named msagent and starts it.
msagent.sys carries a digital signature issued to Nanjing Ranyi Technology Co., Ltd., valid from August 2013 through September 2014. Several older malicious drivers, compiled around 2013 and bearing the same certificate, have been identified previously, though no direct connection between those earlier samples and the current CoolClient campaign has been established.
How CoolClient Communicates With the Driver: IOCTL Commands
Once loaded, the driver accepts commands from CoolClient’s user-mode component through IOCTL requests – the standard mechanism Windows uses for communication between ordinary programs and drivers. In the sample examined, CoolClient issued three distinct requests during normal operation.
Request 0x222120 registers the current CoolClient process as trusted. Once registered, the driver permits the malicious process to access files, registry keys, and other processes that remain off-limits to every other application. This allows CoolClient to retain full access to its own components even while msagent.sys hides or protects them from everything else.
Request 0x2221E0 passes the command server’s IPv4 address to the driver. msagent.sys uses this address to filter network information that Windows would otherwise surface to user-level applications.
Request 0x2220F0 communicates the file paths and registry keys that require protection. In the configuration examined, CoolClient supplied its own installation directory along with the registry key associated with the malware’s service. Once these paths are registered, other programs may lose the ability to view, modify, or delete the corresponding objects.
Registry-Based Configuration and Kernel-Level Concealment
msagent.sys stores its concealment settings within the registry branch \REGISTRY\MACHINE\SYSTEM\RNG. Separate parameters exist for directories, files, registry keys and values, and processes. The configuration specifies which objects to hide, which to protect, and which to exclude from processing entirely.
To maintain control over the system, the driver registers handlers for the file system, the registry, processes, kernel objects, and executable image loading. Whenever Windows performs an operation on an object included in the protection list, msagent.sys can alter the result or block the action outright.
When protecting processes, the driver restricts the permissions another program receives upon opening a handle to the protected process. That handle is what an application needs to perform actions against another process. If msagent.sys strips those permissions, a program becomes unable to, for instance, terminate the protected process or inject its own code into it. In the infection examined, the driver protected synchost.exe, the process into which CoolClient had earlier injected its code.
msagent.sys can also fully hide processes by removing a selected entry from Windows’ internal list of active processes. The underlying code continues running normally, but any program retrieving the process list through standard system structures may fail to see the hidden entry at all.
File, Registry, and Network Concealment Mechanisms
Files and directories are protected by a Windows file system minifilter. The minifilter intercepts access requests targeting selected objects and, when necessary, returns an access-denied result. A user or program may know the exact path to a malicious file, yet any read, modification, or deletion attempt will still fail.
A similar mechanism applies to the registry. The driver registers a handler that intervenes in requests directed at protected keys and values. When a registry key’s contents are enumerated, msagent.sys strips the relevant entries from the results, causing system utilities or security products to receive an incomplete listing. Attempts to modify or delete protected values are blocked through a separate mechanism.
To conceal connections to the command server, the rootkit interferes with the Windows Nsiproxy driver, through which user-level applications obtain a portion of their network connection data. msagent.sys filters the command server’s IPv4 address out of the results it returns, causing certain network monitoring tools to potentially miss the corresponding connection entirely.
33 IOCTL Handlers – Only Three Actively Used
In total, 33 distinct IOCTL handlers were identified within msagent.sys. The driver includes functionality for hiding processes and kernel modules, altering registry values, and interacting with Windows kernel notification systems. During normal execution of the sample examined, however, CoolClient made use of only three commands: registering a trusted process, transmitting the command server’s IPv4 address, and configuring protected paths. Use of the remaining handlers was not observed in the analyzed attack.
Indicators of Compromise
Indicators of compromise have been published to assist detection efforts. Two identified msagent.sys samples carry the hashes 2d7c8780e97409770a9d4f31c66c9d63 and 9460E150E1981D5C165043520c5c12fe. For libngs.dll, the identified hashes are 9717f005c5fb98e08d2ad983d88f94ee and F518D8E5FE70D9090F6280C68A95998F. The full indicator set also includes malicious file paths and command server domains.
A Pattern of Kernel-Level Rootkit Deployment
HoneyMyte has employed kernel-level rootkits before. In January 2026, researchers documented a different CoolClient variant, deployed against targets in Pakistan and Myanmar, that launched a previously unknown driver. In December 2025, the group also used a separate kernel-level rootkit to deploy its ToneShell backdoor.
The current CoolClient driver bears structural similarities to the component previously used alongside ToneShell. However, msagent.sys features its own distinct set of IOCTL commands for direct communication with the backdoor’s user-mode component. CoolClient itself instructs the driver which process to treat as trusted, which files and registry entries to shield from unauthorized access, and which command server address to strip from Windows’ network information.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
