# HoneyMyte (Mustang Panda) CoolClient Backdoor Update with Browser Data Stealers Targeting Southeast Asian Government and Military

> Kaspersky researchers identified three new variants of the CoolClient backdoor and three browser data stealer variants attributed to HoneyMyte (Mustang Panda/Earth Preta). The campaign targets government and military organizations in Southeast Asia using DLL sideloading, registry persistence, scheduled tasks, and custom exfiltration modules to steal credentials, documents, and browser data via FTP, Pixeldrain, and Google Drive.

- **Published:** 2026-03-09T12:00:00Z
- **Last reviewed:** 2026-09-19T09:01:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0197
- **ID:** TL-2026-0197
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MUSTANG PANDA (China)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

HoneyMyte, also tracked as Mustang Panda, Earth Preta, Bronze President, RedDelta, BASIN, and Camaro Dragon, is a China-nexus advanced persistent threat group that has been active since at least 2012. In 2025-2026, Kaspersky documented a significant expansion of the group's toolset centered around the CoolClient backdoor and new browser credential stealing capabilities.

CoolClient Backdoor Architecture:
CoolClient employs a multi-stage execution chain built on DLL sideloading. The group abuses legitimate signed executables from Sangfor (sang.exe), BitDefender (qutppy.exe), VLC Media Player (vlc.exe renamed as googleupdate.exe), and Ulead PhotoImpact (olreg.exe) to load a malicious DLL (libngs.dll). This loader decrypts and executes encrypted second-stage (loader.dat), third-stage (main.dat), and configuration (time.dat) payloads entirely in memory. The backdoor communicates over raw TCP using magic values (0xFFAABBCC for beacon/configuration, 0xFFAABBCD for operational commands) and supports in-memory plugin loading for service management (ServiceMgrS.dll), file operations (FileMgrS.dll), and remote shell access (RemoteShellS.dll).

Core Capabilities:
CoolClient provides comprehensive host surveillance including keylogging, clipboard monitoring (output stored XOR-encrypted with key 0xAC to C:\ProgramData\AppxProvisioning.xml), active window monitoring, HTTP proxy credential interception via raw TCP packet analysis extracting Base64-encoded Proxy-Authorization headers, file search and exfiltration, reverse tunnel and proxy setup, and UAC bypass through svchost.exe PEB spoofing and access token duplication from elevated processes.

Browser Data Stealers:
Three distinct browser credential stealers were deployed: Variant A targets Google Chrome Login Data and Local State files, Variant B targets Microsoft Edge, and Variant C is a generalized Chromium-based browser stealer. All variants use SQL queries against the Login Data SQLite database (SELECT origin_url, username_value, password_value FROM logins) and decrypt DPAPI-protected credentials. Stolen data is staged to C:\Users\Public\Libraries\License.txt before exfiltration.

Reconnaissance and Exfiltration Scripts:
The campaign deploys batch and PowerShell scripts for comprehensive host profiling. A batch script (1.bat) performs network mapping via nbtscan, system enumeration, registry inspection, antivirus detection, and credential dumping, with results uploaded via FTP to 113.23.212.15. PowerShell scripts (Ttraazcs32.ps1 and t.ps1) enumerate public IP, Wi-Fi networks, and recently modified documents across all drives, exfiltrating via FTP and the Pixeldrain API using hardcoded authentication tokens. Document theft targets .doc, .xls, .pdf, .tif, and .txt files modified within 60 days, compressed with RAR using the password PIXELDRAIN. Google Drive OAuth tokens are also abused for browser cookie exfiltration.

The campaign primarily targets government and military entities in Southeast Asia including Myanmar, Philippines, Vietnam, Thailand, Mongolia, Malaysia, Pakistan, and Russia. CoolClient is frequently deployed as a secondary backdoor alongside PlugX and LuminousMoth infections, suggesting operational overlap or shared infrastructure between these threat clusters.

---

**Revalidated on 2026-03-12**

Post-PlugX Tactical Pivot:
The January 2025 FBI/DOJ takedown of Mustang Panda's PlugX infrastructure (4,258 U.S. systems cleaned in coordination with French law enforcement and Sekoia.io) provides critical strategic context for this campaign. The group's 2025-2026 pivot to CoolClient as a primary implant, alongside TONESHELL and LOTUSLITE, represents a deliberate retooling response to the loss of their decade-old PlugX capability. CoolClient's in-memory execution, encrypted multi-stage payloads, and raw TCP C2 protocol demonstrate lessons learned from PlugX's detection and takedown.

Concurrent Operations (January 2026):
Simultaneously with the CoolClient browser stealer campaign documented in this threat, Mustang Panda launched the LOTUSLITE backdoor against U.S. government and policy organizations using Venezuela-themed spear phishing ('US now deciding what’s next for Venezuela.zip'). LOTUSLITE is a custom C++ implant sharing DLL sideloading tradecraft with CoolClient but targeting a distinctly Western audience, indicating parallel operational teams or infrastructure.

SnakeDisk USB Propagation Vector:
In August 2025, the SnakeDisk USB worm was discovered targeting Thailand-based IP addresses exclusively, deploying the Yokai backdoor via removable media. This overlaps geographically and temporally with CoolClient deployments in Southeast Asia and introduces a physical propagation vector (USB drives) not covered by the existing CoolClient network-focused detection set.

Kernel-Mode Rootkit Technical Details:
The ProjectConfiguration.sys rootkit driver is signed with a stolen/expired certificate from Guangzhou Kingteller Technology Co., Ltd. (serial: 08:01:CC:11:EB:4D:1D:33:1E:3D:54:0C:55:A4:9F:7F, valid 2012-2015). It registers as a kernel minifilter to protect TONESHELL backdoor files, processes, and registry keys from detection and removal, representing a significant escalation in the group's defensive evasion capabilities.

## MITRE ATT&CK

- T1566 Phishing
- T1091 Replication Through Removable Media
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1204 User Execution
- T1129 Shared Modules
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1557 Adversary-in-the-Middle
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1056 Input Capture
- T1115 Clipboard Data
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1074 Data Staged
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Kaspersky Securelist - HoneyMyte Updates CoolClient Backdoor, Uses New Data Stealing Tools](https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/)
- [The Hacker News - Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks](https://thehackernews.com/2026/01/mustang-panda-deploys-updated.html)
- [MITRE ATT&CK - Mustang Panda Group Profile (G0129)](https://attack.mitre.org/groups/G0129/)
- [GBHackers - HoneyMyte Hacker Group Expands CoolClient Malware With New Advanced Toolset](https://gbhackers.com/honeymyte-hacker-2/)
- [SecurityWeek - Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit](https://www.securityweek.com/chinese-apt-mustang-panda-caught-using-kernel-mode-rootkit/)
- [Trend Micro - Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection](https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html)
- [Kaspersky Securelist - HoneyMyte APT Protects Malware with Kernel-Mode Rootkit](https://securelist.com/honeymyte-kernel-mode-rootkit/118590/)
- [Cyble - Mustang Panda Threat Actor Profile](https://cyble.com/threat-actor-profiles/mustang-panda/)
- [Malpedia - Mustang Panda Actor Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/mustang_panda)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0197