HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)
HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with (TL-2026-2013) is a high-severity malware campaign, first published 2026-08-14. It is attributed to Mustang Panda (China) with high confidence, affects Microsoft Windows (x64), maps to 16 MITRE ATT&CK techniques (T1014, T1027, T1053.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2013
- Threat ID
- TL-2026-2013
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-14
- Last reviewed
- 2026-08-14
- Attribution
- Mustang Panda
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration
- Target regions
- myanmar, mongolia, pakistan, russia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
Malware and tooling: PlugX
Kaspersky GReAT documents HoneyMyte (Mustang Panda) equipping its CoolClient backdoor with a signed kernel-mode Windows driver, msagent.sys, that hides processes, files, registry artifacts, and network connections. The upgraded implant was deployed as a secondary payload after PlugX infections against government entities in Myanmar, Mongolia, Pakistan, and Russia through late 2025 and into 2026, using Sangfor DLL sideloading, an RPC-based UAC bypass, and process hollowing into synchost.exe.
How HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with works
Kaspersky's GReAT team (Securelist, published 2026-08-14) reports that HoneyMyte — the China-nexus espionage actor also tracked as Mustang Panda, Earth Preta, Bronze President, Stately Taurus, RedDelta, and TA416 — has hardened its CoolClient backdoor with a kernel-mode rootkit driver named msagent.sys. CoolClient is deployed as a secondary implant following initial PlugX compromise. Execution begins with DLL side-loading: a legitimate, digitally signed Sangfor executable (Sang.exe, renamed defender.exe on disk under a spoofed 'C:\Program Files\Microsoft\Windows Defender\' path) side-loads the malicious libngs.dll loader, which XOR-decrypts (0x32-byte repeating key seeded from 0xA4) a second stage (loadcert.ini) that in turn XOR-decrypts (0x4D-seeded key) the final backdoor stage (cert.ini) and LZMA-decompresses the embedded msagent.sys driver.
Before deployment the malware excludes its install directory from Microsoft Defender via a WMIC MSFT_MpPreference call, checks for 360 Total Security processes (360sd.exe, zhudongfangyu.exe, 360desktopservice64.exe, escanmon.exe) to avoid detection, and establishes triple-redundant persistence: an autorun registry value ('goopdate') under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a SYSTEM-privileged Windows service (media_updaten), and a SYSTEM-privileged scheduled task masquerading as 'Windows Defender Advanced Threat Protection Service'. Privilege escalation uses an RPC-based UAC bypass: the malware connects to a local ncalrpc endpoint, invokes NdrAsyncClientCall to launch winver.exe through the RPC interface, retrieves a debug object via NtQueryInformationProcess/DbgUiSetThreadDebugObject, and spoofs its parent process via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS so the elevated child appears spawned by a trusted Windows process. CoolClient's core logic is then injected into synchost.exe using classic process-hollowing (suspended process, remote memory allocation, thread-context redirection, ResumeThread, and termination of the original process).
The headline addition is msagent.sys, a kernel-mode rootkit driver code-signed with a certificate issued to 'Nanjing Ranyi Technology Co., Ltd.' (serial 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD, nominal validity August 2013-September 2014) and built from a PDB path referencing a Nanjing-based development lab. The driver creates device object \Device\ToolTool (symbolic link \DosDevices\ToolTool) and reads its hiding configuration from \REGISTRY\MACHINE\SYSTEM\RNG (values Hid_State, Hid_StealthMode, Wid_H1deF5Dirs, Wid_H1deF5Files, Wid_H1deRegKeys, Wid_H1deRegValues, Hid_IgnoredImages, Hid_ProtectedImages). Of 33 IOCTL handlers, three are actively used to register the CoolClient process as trusted, register the C2 IPv4 address for network filtering, and register filesystem/registry paths for protection. The driver hides processes by unlinking them from EPROCESS ActiveProcessLinks and hides kernel modules by unlinking from PsLoadedModuleList; protects processes/threads from tampering via ObRegisterCallbacks (altitude 1203); tracks and filters process/image-load events via PsSetCreateProcessNotifyRoutineEx and PsSetLoadImageNotifyRoutine; hides files and directories via a dynamically-registered minifilter (FltRegisterFilter); hides registry keys/values and returns STATUS_ACCESS_DENIED to direct access attempts via CmRegisterCallbackEx (altitude 320000); and hooks \Driver\Nsiproxy to strip the registered C2 address out of network information returned to user-mode tools, defeating netstat-style connection monitoring.
Kaspersky assesses attribution to HoneyMyte with high confidence based on the consistent PlugX-then-CoolClient deployment chain, matching geographic targeting, and the actor's prior documented expansion into kernel-mode tooling — HoneyMyte previously fielded a kernel driver (ProjectConfiguration.sys, disclosed by Securelist 2025-12-29) to protect its ToneShell backdoor. A separate Securelist report (2026-01-27) on the same CoolClient family documented parallel toolset growth (clipboard/HTTP-proxy-credential stealers, three browser-login-stealer variants, and PowerShell/batch exfiltration scripts), with code-level overlap (shared 'ChromeTmp' temp-folder naming and file-copy logic) suggesting possible tool reuse or a shared codebase with LuminousMoth. Confirmed msagent.sys-equipped intrusions targeted government entities in Myanmar, Mongolia, Pakistan, and Russia through late 2025 and 2026, continuing HoneyMyte's long-running focus on Southeast and South Asian government networks.
MITRE ATT&CK techniques used in TL-2026-2013
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1055.012 Process Injection: Process Hollowing; T1134.004 Access Token Manipulation: Parent PID Spoofing; T1564.001 Hide Artifacts: Hidden Files and Directories; T1574.001 DLL
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Command and Control
T1071 Application Layer Protocol
Execution
defense-impairment
T1112 Modify Registry; T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools
Discovery
T1518.001 Software Discovery: Security Software Discovery
Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Affected products and versions in HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
- Microsoft — Windows (x64)
Vulnerable versions: all supported 64-bit Windows versions targeted by CoolClient/msagent.sys intrusions
Remediation for HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
Immediate actions
- Block the reported C2 domains at DNS/perimeter: cloudtroe.giize.com, employers.theworkpc.com, freeread.casacam.net, us.lenovoappstore.com, sundanish.freeddns.org, torinarlabs.webredirect.org, news.dursamjbataar.org, video.dursamjbataar.org, black-popular.com, whatismybestthing.com
- Hunt for and quarantine the reported file hashes (msagent.sys, libngs.dll, ctxmui.dll) across endpoints
- Hunt for the Windows service 'media_updaten', scheduled task 'Windows Defender Advanced Threat Protection Service', and autorun value 'goopdate' under HKCU Run
- Hunt for device object \Device\ToolTool and registry hive \REGISTRY\MACHINE\SYSTEM\RNG as direct rootkit-presence indicators
- Revoke trust for / blocklist the 'Nanjing Ranyi Technology Co., Ltd.' code-signing certificate (serial 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD) via Microsoft's vulnerable/malicious driver blocklist (WDAC / HVCI)
Workarounds
- Restrict/deny driver loading from unrecognized publishers via WDAC policy where HVCI cannot be enabled
- Restrict outbound traffic to the reported C2 domains/newly-registered-domain patterns typical of HoneyMyte infrastructure
Longer-term hardening
- Enable Windows HVCI/Memory Integrity and Microsoft's recommended driver blocklist to prevent unauthorized signed-driver loading
- Deploy EDR with kernel callback and minifilter registration visibility (many EDRs miss activity hidden by ObRegisterCallbacks/CmRegisterCallbackEx-based rootkits)
- Monitor for anomalous WMIC Defender-exclusion commands and newly created SYSTEM-privileged services/scheduled tasks
- Audit third-party signed drivers permitted to load, especially from lesser-known Chinese software vendors used in past DLL side-loading chains (e.g., Sangfor)
- Monitor for RPC calls to ncalrpc endpoints combined with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS usage as a UAC-bypass/PPID-spoofing indicator
Timeline of HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
- CoolClient backdoor first publicly disclosed by Sophos (approximate date; source cites year only).
- Trend Micro publishes updated CoolClient analysis (approximate date; source cites year only).
- msagent.sys-equipped CoolClient intrusions observed in the wild against government entities in Myanmar, Mongolia, Pakistan, and Russia, continuing through 2026 (start date approximate, per 'late 2025' in source).
- Kaspersky Securelist discloses HoneyMyte's prior kernel-mode rootkit driver, ProjectConfiguration.sys, protecting the actor's ToneShell backdoor — the precedent for the msagent.sys rootkit.
- Kaspersky Securelist reports HoneyMyte updating CoolClient with clipboard/HTTP-proxy-credential theft, three browser-login-stealer variants, and new exfiltration scripts, targeting Myanmar, Mongolia, Malaysia, Thailand, and Russia.
- Kaspersky GReAT (Securelist) publishes the full technical analysis of CoolClient's kernel-mode rootkit driver msagent.sys, including its capabilities, IOCTL interface, code-signing certificate, and campaign IOCs.
Sources cited for HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
- APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
- The HoneyMyte APT now protects malware with a kernel-mode rootkit
- HoneyMyte updates CoolClient backdoor, uses new data stealing tools
- Mustang Panda, TA416, RedDelta, BRONZE PRESIDENT, ... Group G0129
- Kaspersky reveals new HoneyMyte APT campaigns and toolset
- HoneyMyte's CoolClient Malware Now Steals Browser Logins In Latest Variant
- HoneyMyte Adds New Tools To Boost CoolClient Malware
- Dark Web Profile: Mustang Panda
Threats related to HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with
Detection coverage for TL-2026-2013
As of 2026-08-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2013 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.