HoneyMyte (Mustang Panda) CoolClient Backdoor Update with Browser Data Stealers Targeting Southeast Asian Government and Military
HoneyMyte (Mustang Panda) CoolClient Backdoor Update with (TL-2026-0197), also tracked as HoneyMyte CoolClient Campaign 2025-2026, is a high-severity advanced persistent threat campaign, first published 2026-03-09. It is attributed to MUSTANG PANDA (China) with high confidence, affects Multiple Windows-based Government Systems, maps to 38 MITRE ATT&CK techniques (T1003, T1016, T1027), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0197
- Threat ID
- TL-2026-0197
- Also known as
- HoneyMyte CoolClient Campaign 2025-2026, Operation CoolClient
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-09
- Last reviewed
- 2026-03-09
- Attribution
- MUSTANG PANDA
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, military, defense, diplomatic, foreign-affairs
- Target regions
- Southeast Asia, Philippines, Vietnam, Myanmar, Thailand, Mongolia, Malaysia, Pakistan, Russia, East Asia, Europe
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
Malware and tooling: Browser Data Stealer, CoolClient, NBTScan
Kaspersky researchers identified three new variants of the CoolClient backdoor and three browser data stealer variants attributed to HoneyMyte (Mustang Panda/Earth Preta). The campaign targets government and military organizations in Southeast Asia using DLL sideloading, registry persistence, scheduled tasks, and custom exfiltration modules to steal credentials, documents, and browser data via FTP, Pixeldrain, and Google Drive.
How HoneyMyte (Mustang Panda) CoolClient Backdoor Update with works
HoneyMyte, also tracked as Mustang Panda, Earth Preta, Bronze President, RedDelta, BASIN, and Camaro Dragon, is a China-nexus advanced persistent threat group that has been active since at least 2012. In 2025-2026, Kaspersky documented a significant expansion of the group's toolset centered around the CoolClient backdoor and new browser credential stealing capabilities.
CoolClient Backdoor Architecture: CoolClient employs a multi-stage execution chain built on DLL sideloading. The group abuses legitimate signed executables from Sangfor (sang.exe), BitDefender (qutppy.exe), VLC Media Player (vlc.exe renamed as googleupdate.exe), and Ulead PhotoImpact (olreg.exe) to load a malicious DLL (libngs.dll). This loader decrypts and executes encrypted second-stage (loader.dat), third-stage (main.dat), and configuration (time.dat) payloads entirely in memory. The backdoor communicates over raw TCP using magic values (0xFFAABBCC for beacon/configuration, 0xFFAABBCD for operational commands) and supports in-memory plugin loading for service management (ServiceMgrS.dll), file operations (FileMgrS.dll), and remote shell access (RemoteShellS.dll).
Core Capabilities: CoolClient provides comprehensive host surveillance including keylogging, clipboard monitoring (output stored XOR-encrypted with key 0xAC to C:\ProgramData\AppxProvisioning.xml), active window monitoring, HTTP proxy credential interception via raw TCP packet analysis extracting Base64-encoded Proxy-Authorization headers, file search and exfiltration, reverse tunnel and proxy setup, and UAC bypass through svchost.exe PEB spoofing and access token duplication from elevated processes.
Browser Data Stealers: Three distinct browser credential stealers were deployed: Variant A targets Google Chrome Login Data and Local State files, Variant B targets Microsoft Edge, and Variant C is a generalized Chromium-based browser stealer. All variants use SQL queries against the Login Data SQLite database (SELECT origin_url, username_value, password_value FROM logins) and decrypt DPAPI-protected credentials. Stolen data is staged to C:\Users\Public\Libraries\License.txt before exfiltration.
Reconnaissance and Exfiltration Scripts: The campaign deploys batch and PowerShell scripts for comprehensive host profiling. A batch script (1.bat) performs network mapping via nbtscan, system enumeration, registry inspection, antivirus detection, and credential dumping, with results uploaded via FTP to 113.23.212.15. PowerShell scripts (Ttraazcs32.ps1 and t.ps1) enumerate public IP, Wi-Fi networks, and recently modified documents across all drives, exfiltrating via FTP and the Pixeldrain API using hardcoded authentication tokens. Document theft targets .doc, .xls, .pdf, .tif, and .txt files modified within 60 days, compressed with RAR using the password PIXELDRAIN. Google Drive OAuth tokens are also abused for browser cookie exfiltration.
The campaign primarily targets government and military entities in Southeast Asia including Myanmar, Philippines, Vietnam, Thailand, Mongolia, Malaysia, Pakistan, and Russia. CoolClient is frequently deployed as a secondary backdoor alongside PlugX and LuminousMoth infections, suggesting operational overlap or shared infrastructure between these threat clusters.
---
**Revalidated on 2026-03-12**
Post-PlugX Tactical Pivot: The January 2025 FBI/DOJ takedown of Mustang Panda's PlugX infrastructure (4,258 U.S. systems cleaned in coordination with French law enforcement and Sekoia.io) provides critical strategic context for this campaign. The group's 2025-2026 pivot to CoolClient as a primary implant, alongside TONESHELL and LOTUSLITE, represents a deliberate retooling response to the loss of their decade-old PlugX capability. CoolClient's in-memory execution, encrypted multi-stage payloads, and raw TCP C2 protocol demonstrate lessons learned from PlugX's detection and takedown.
Concurrent Operations (January 2026): Simultaneously with the CoolClient browser stealer campaign documented in this threat, Mustang Panda launched the LOTUSLITE backdoor against U.S. government and policy organizations using Venezuela-themed spear phishing ('US now deciding what’s next for Venezuela.zip'). LOTUSLITE is a custom C++ implant sharing DLL sideloading tradecraft with CoolClient but targeting a distinctly Western audience, indicating parallel operational teams or infrastructure.
SnakeDisk USB Propagation Vector: In August 2025, the SnakeDisk USB worm was discovered targeting Thailand-based IP addresses exclusively, deploying the Yokai backdoor via removable media. This overlaps geographically and temporally with CoolClient deployments in Southeast Asia and introduces a physical propagation vector (USB drives) not covered by the existing CoolClient network-focused detection set.
Kernel-Mode Rootkit Technical Details: The ProjectConfiguration.sys rootkit driver is signed with a stolen/expired certificate from Guangzhou Kingteller Technology Co., Ltd. (serial: 08:01:CC:11:EB:4D:1D:33:1E:3D:54:0C:55:A4:9F:7F, valid 2012-2015). It registers as a kernel minifilter to protect TONESHELL backdoor files, processes, and registry keys from detection and removal, representing a significant escalation in the group's defensive evasion capabilities.
MITRE ATT&CK techniques used in TL-2026-0197
credential-access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores; T1557 Adversary-in-the-Middle
discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1134 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information
exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1204 User Execution
collection
T1056 Input Capture; T1074 Data Staged; T1115 Clipboard Data; T1119 Automated Collection; T1560 Archive Collected Data
command-and-control
T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel
lateral-movement
T1091 Replication Through Removable Media
persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution; T1574 Hijack Execution Flow
privilege-escalation
T1548 Abuse Elevation Control Mechanism
initial-access
Affected products and versions in HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
- Multiple — Windows-based Government Systems
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Google — Chrome Browser
Vulnerable versions: All versions (credential theft target) - Microsoft — Edge Browser
Vulnerable versions: All Chromium-based versions (credential theft target) - Sangfor — Various Products
Vulnerable versions: Versions with sang.exe susceptible to DLL sideloading - Bitdefender — Security Products
Vulnerable versions: Versions with qutppy.exe susceptible to DLL sideloading
Remediation for HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
Immediate actions
- Block C2 domains: account.hamsterxnxx.com, popnike-share.com, japan.Lenovoappstore.com at DNS and proxy level
- Block IP addresses 113.23.212.15 and 45.144.165.65 at perimeter firewall
- Hunt for DLL sideloading indicators: libngs.dll loaded by sang.exe, qutppy.exe, googleupdate.exe, or olreg.exe
- Search for persistence artifacts: media_updaten service, ComboxResetTask scheduled task, suspicious Run key entries
- Scan for staging files: C:\Users\Public\Libraries\License.txt, C:\ProgramData\AppxProvisioning.xml
- Block FTP outbound to untrusted destinations
- Monitor for Pixeldrain and unusual Google Drive API access
Workarounds
- Restrict execution of renamed legitimate executables (e.g., vlc.exe renamed to googleupdate.exe)
- Disable unnecessary FTP client capabilities on endpoints
- Remove or restrict access to RAR/compression utilities on sensitive systems
Longer-term hardening
- Deploy EDR with behavioral detection for DLL sideloading and in-memory payload execution
- Implement application whitelisting to prevent abuse of legitimate signed executables
- Enable PowerShell script block logging and constrained language mode
- Deploy network monitoring for raw TCP C2 with magic value signatures
- Implement browser credential protection policies and DPAPI hardening
- Segment networks to limit lateral movement and NBTscan reconnaissance effectiveness
- Monitor for credential theft from HTTP proxy Proxy-Authorization headers
Weaknesses (CWE) in HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
CWE-426, CWE-522
Timeline of HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
- Earliest observed CoolClient variants using DLL sideloading via BitDefender and VLC Media Player executables
- Sophos documents early version of CoolClient backdoor associated with Mustang Panda campaigns
- Trend Micro publishes updated CoolClient analysis documenting Earth Preta DLL sideloading evolution
- Mustang Panda deploys advanced malware to spy on Asia-Pacific governments with expanded toolset including TONESHELL and QReverse
- FBI/DOJ international operation deletes PlugX malware from 4,258 U.S. computers in coordination with French law enforcement and Sekoia.io, disrupting Mustang Panda''s primary implant infrastructure
- Trend Micro reports Earth Preta mixing legitimate and malicious components to sidestep detection including signed driver abuse
- HoneyMyte updates CoolClient with enhanced capabilities: clipboard monitoring, HTTP proxy credential theft, and UAC bypass via PEB spoofing
- SnakeDisk USB worm discovered targeting Thailand-based IP addresses, deploying Yokai backdoor via removable media propagation
- Three browser data stealer variants (Chrome, Edge, Chromium) deployed alongside CoolClient in Southeast Asian government networks
- Kaspersky discloses HoneyMyte kernel-mode rootkit protecting ToneShell backdoor with signed mini-filter driver
- LOTUSLITE backdoor campaign targeting U.S. government and policy organizations using Venezuela-themed spear phishing lures, demonstrating Mustang Panda''s geographic expansion post-PlugX takedown
- The Hacker News reports on updated COOLCLIENT deployment in government cyber attacks across Myanmar, Mongolia, Malaysia, and Russia
- Trend Micro publishes 2025 MITRE ATT&CK Evaluation Round 7 results featuring Earth Preta as emulated adversary, validating group''s global threat significance
- GBHackers reports on HoneyMyte expanding CoolClient malware with new advanced toolset targeting Asia and Europe
- Kaspersky Securelist publishes comprehensive analysis of CoolClient backdoor update, three browser stealer variants, and reconnaissance/exfiltration scripts with full IOCs
- As of 2026-05-29, this HoneyMyte/Mustang Panda CoolClient espionage campaign remains ACTIVE: it has no CVE to patch, and the China-nexus actor stayed operational through the 2025 PlugX takedown by retooling, with Darktrace tracking related intrusions into April 2026. The group is not disrupted or superseded and continues targeting Asia-Pacific government/military entities.
Sources cited for HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
- Kaspersky Securelist - HoneyMyte Updates CoolClient Backdoor, Uses New Data Stealing Tools
- The Hacker News - Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks
- MITRE ATT&CK - Mustang Panda Group Profile (G0129)
- GBHackers - HoneyMyte Hacker Group Expands CoolClient Malware With New Advanced Toolset
- SecurityWeek - Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
- Trend Micro - Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection
- Kaspersky Securelist - HoneyMyte APT Protects Malware with Kernel-Mode Rootkit
- Cyble - Mustang Panda Threat Actor Profile
- Malpedia - Mustang Panda Actor Profile
Threats related to HoneyMyte (Mustang Panda) CoolClient Backdoor Update with
Detection coverage for TL-2026-0197
As of 2026-03-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0197 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.