# HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)

> Kaspersky GReAT documents HoneyMyte (Mustang Panda) equipping its CoolClient backdoor with a signed kernel-mode Windows driver, msagent.sys, that hides processes, files, registry artifacts, and network connections. The upgraded implant was deployed as a secondary payload after PlugX infections against government entities in Myanmar, Mongolia, Pakistan, and Russia through late 2025 and into 2026, using Sangfor DLL sideloading, an RPC-based UAC bypass, and process hollowing into synchost.exe.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2013
- **ID:** TL-2026-2013
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kaspersky's GReAT team (Securelist, published 2026-08-14) reports that HoneyMyte — the China-nexus espionage actor also tracked as Mustang Panda, Earth Preta, Bronze President, Stately Taurus, RedDelta, and TA416 — has hardened its CoolClient backdoor with a kernel-mode rootkit driver named msagent.sys. CoolClient is deployed as a secondary implant following initial PlugX compromise. Execution begins with DLL side-loading: a legitimate, digitally signed Sangfor executable (Sang.exe, renamed defender.exe on disk under a spoofed 'C:\Program Files\Microsoft\Windows Defender\' path) side-loads the malicious libngs.dll loader, which XOR-decrypts (0x32-byte repeating key seeded from 0xA4) a second stage (loadcert.ini) that in turn XOR-decrypts (0x4D-seeded key) the final backdoor stage (cert.ini) and LZMA-decompresses the embedded msagent.sys driver.

Before deployment the malware excludes its install directory from Microsoft Defender via a WMIC MSFT_MpPreference call, checks for 360 Total Security processes (360sd.exe, zhudongfangyu.exe, 360desktopservice64.exe, escanmon.exe) to avoid detection, and establishes triple-redundant persistence: an autorun registry value ('goopdate') under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a SYSTEM-privileged Windows service (media_updaten), and a SYSTEM-privileged scheduled task masquerading as 'Windows Defender Advanced Threat Protection Service'. Privilege escalation uses an RPC-based UAC bypass: the malware connects to a local ncalrpc endpoint, invokes NdrAsyncClientCall to launch winver.exe through the RPC interface, retrieves a debug object via NtQueryInformationProcess/DbgUiSetThreadDebugObject, and spoofs its parent process via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS so the elevated child appears spawned by a trusted Windows process. CoolClient's core logic is then injected into synchost.exe using classic process-hollowing (suspended process, remote memory allocation, thread-context redirection, ResumeThread, and termination of the original process).

The headline addition is msagent.sys, a kernel-mode rootkit driver code-signed with a certificate issued to 'Nanjing Ranyi Technology Co., Ltd.' (serial 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD, nominal validity August 2013-September 2014) and built from a PDB path referencing a Nanjing-based development lab. The driver creates device object \Device\ToolTool (symbolic link \DosDevices\ToolTool) and reads its hiding configuration from \REGISTRY\MACHINE\SYSTEM\RNG (values Hid_State, Hid_StealthMode, Wid_H1deF5Dirs, Wid_H1deF5Files, Wid_H1deRegKeys, Wid_H1deRegValues, Hid_IgnoredImages, Hid_ProtectedImages). Of 33 IOCTL handlers, three are actively used to register the CoolClient process as trusted, register the C2 IPv4 address for network filtering, and register filesystem/registry paths for protection. The driver hides processes by unlinking them from EPROCESS ActiveProcessLinks and hides kernel modules by unlinking from PsLoadedModuleList; protects processes/threads from tampering via ObRegisterCallbacks (altitude 1203); tracks and filters process/image-load events via PsSetCreateProcessNotifyRoutineEx and PsSetLoadImageNotifyRoutine; hides files and directories via a dynamically-registered minifilter (FltRegisterFilter); hides registry keys/values and returns STATUS_ACCESS_DENIED to direct access attempts via CmRegisterCallbackEx (altitude 320000); and hooks \Driver\Nsiproxy to strip the registered C2 address out of network information returned to user-mode tools, defeating netstat-style connection monitoring.

Kaspersky assesses attribution to HoneyMyte with high confidence based on the consistent PlugX-then-CoolClient deployment chain, matching geographic targeting, and the actor's prior documented expansion into kernel-mode tooling — HoneyMyte previously fielded a kernel driver (ProjectConfiguration.sys, disclosed by Securelist 2025-12-29) to protect its ToneShell backdoor. A separate Securelist report (2026-01-27) on the same CoolClient family documented parallel toolset growth (clipboard/HTTP-proxy-credential stealers, three browser-login-stealer variants, and PowerShell/batch exfiltration scripts), with code-level overlap (shared 'ChromeTmp' temp-folder naming and file-copy logic) suggesting possible tool reuse or a shared codebase with LuminousMoth. Confirmed msagent.sys-equipped intrusions targeted government entities in Myanmar, Mongolia, Pakistan, and Russia through late 2025 and 2026, continuing HoneyMyte's long-running focus on Southeast and South Asian government networks.

## MITRE ATT&CK

- T1574.001 DLL
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1134.004 Access Token Manipulation: Parent PID Spoofing
- T1055.012 Process Injection: Process Hollowing
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1112 Modify Registry
- T1553.002 Subvert Trust Controls: Code Signing
- T1106 Native API
- T1518.001 Software Discovery: Security Software Discovery
- T1071 Application Layer Protocol
- T1027 Obfuscated Files or Information

## Sources

- [APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit](https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/)
- [The HoneyMyte APT now protects malware with a kernel-mode rootkit](https://securelist.com/honeymyte-kernel-mode-rootkit/118590/)
- [HoneyMyte updates CoolClient backdoor, uses new data stealing tools](https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/)
- [Mustang Panda, TA416, RedDelta, BRONZE PRESIDENT, ... Group G0129](https://attack.mitre.org/groups/G0129/)
- [Kaspersky reveals new HoneyMyte APT campaigns and toolset](https://www.kaspersky.com/about/press-releases/kaspersky-reveals-new-honeymyte-apt-campaigns-and-toolset)
- [HoneyMyte's CoolClient Malware Now Steals Browser Logins In Latest Variant](https://cyberpress.org/honeymyte-upgrades-coolclient-stealer/)
- [HoneyMyte Adds New Tools To Boost CoolClient Malware](https://cyberpress.org/honeymyte-boosts-coolclient-malware/)
- [Dark Web Profile: Mustang Panda](https://socradar.io/blog/dark-web-profile-mustang-panda/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2013