HoneyMyte Adds Kernel-Mode Rootkit Capabilities to CoolClient Backdoor
Summary
Researchers analyzed a HoneyMyte CoolClient variant that deploys a signed Windows kernel driver to hide and protect malware processes, files and registry objects, and filter network data. PlugX preceded CoolClient in the observed Myanmar intrusion.
Key points
- The analyzed CoolClient variant is attributed to HoneyMyte (Mustang Panda) and was observed in intrusions in Myanmar, Mongolia, Pakistan and Russia, including against government entities.
- In the Myanmar intrusion, PlugX served as the initial post-compromise implant before CoolClient was deployed.
- A legitimate Sangfor executable sideloads libngs.dll; the malware injects loadcert.ini into synchost.exe before launching cert.ini for command-and-control communication.
- CoolClient installs the signed msagent.sys kernel driver as a service and communicates with it through IOCTL requests to register a trusted process, a C2 address and protected paths.
- The driver uses kernel callbacks, a filesystem minifilter and a registry callback to hide or restrict access to selected processes, files and registry objects.
- Additional driver functions can hide processes and kernel modules and filter registered C2 IP addresses from network information returned through Nsiproxy.
Article Details
- Attack Vectors
- In the Myanmar intrusion, HoneyMyte used PlugX as the initial post-compromise implant to deploy CoolClient.
- CoolClient uses DLL sideloading: a renamed legitimate Sangfor executable, usually Sang.exe and renamed defender.exe, loads the malicious libngs.dll.
- Reported persistence mechanisms include a startup scheduled task, an HKCU Run entry named goopdate, and a Windows service named media_updaten; the driver is installed as a separate service named msagent.
- CoolClient injects its stages into synchost.exe; the final-stage cert.ini implant handles C2 communication.
- When privileges permit, CoolClient deploys the signed kernel-mode driver msagent.sys, which hides or protects processes, files, and registry objects and filters registered C2 IPv4 addresses from returned network information.
- Defensive Notes
- The article reports CoolClient adding Microsoft Defender exclusions for its fake Windows Defender directory and the renamed defender.exe sideloader.
- The article identifies the scheduled task, HKCU Run value goopdate, and services media_updaten and msagent as persistence or driver-installation artifacts.
- The msagent.sys driver can hide processes, modules, files, and registry objects, and filter registered C2 addresses from network information, which can limit visibility from user-mode inspection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | black-popular[.]com | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | cloudtroe[.]giize[.]com | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | employers[.]theworkpc[.]com | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | freeread[.]casacam[.]net | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | news[.]dursamjbataar[.]org | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | sundanish[.]freeddns[.]org | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | torinarlabs[.]webredirect[.]org | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | us[.]lenovoappstore[.]com | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | video[.]dursamjbataar[.]org | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| DOMAIN | whatismybestthing[.]com | Listed as CoolClient campaign C2 or infrastructure; its specific role is not further differentiated. |
| MD5 | 2d7c8780e97409770a9d4f31c66c9d63 | Hash listed for the malicious msagent.sys driver component. |
| MD5 | 9460e150e1981d5c165043520c5c12fe | Hash listed for the malicious msagent.sys driver component. |
| MD5 | 9717f005c5fb98e08d2ad983d88f94ee | Hash listed for the malicious libngs.dll loader. |
| MD5 | eb79558b037669792652a816e2c669de | Hash listed for the malicious ctxmui.dll component. |
| MD5 | f518d8e5fe70d9090f6280c68a95998f | Hash listed for the malicious libngs.dll loader. |
MITRE ATT&CK
T1014 · RootkitThe signed kernel-mode msagent.sys driver provides rootkit-style process, module, file, and registry hiding and protection.T1027 · Obfuscated Files or InformationCoolClient decrypts components with a repeating XOR keystream and uses control-flow flattening in its loader.T1055 · Process InjectionCoolClient injects decrypted stages into suspended synchost.exe processes, modifies thread context, and resumes execution.T1068 · Exploitation for Privilege EscalationCoolClient uses an RPC-based UAC-bypass flow to relaunch itself with elevated privileges.T1112 · Modify RegistryCoolClient writes driver configuration and hiding paths to registry values, including HKLM\SYSTEM\RNG\Wid_H1deF5Dirs.T1134.002 · Create Process with TokenCoolClient duplicates an access token, updates its session identifier, and uses CreateProcessAsUserA to create synchost.exe.T1543.003 · Windows ServiceCoolClient installs Windows services, including media_updaten, and creates the msagent driver service to load msagent.sys.T1547.001 · Registry Run Keys / Startup FolderCoolClient creates the HKCU Run value goopdate to launch its work-stage executable at user logon.T1562.001 · Disable or Modify ToolsBefore deployment, the actor adds Microsoft Defender exclusions for the fake Windows Defender directory and defender.exe.T1562.006 · Indicator BlockingThe driver hides malware processes, modules, files, and registry objects, and removes registered C2 IP addresses from network information returned to user mode.T1574.002 · DLL Side-LoadingA renamed legitimate Sangfor executable loads CoolClient's malicious libngs.dll through DLL sideloading.
Threat Actors
HoneyMyteThe article attributes the CoolClient cyber-espionage activity and the Myanmar PlugX-to-CoolClient deployment to HoneyMyte; it identifies Mustang Panda as an alternate name.Mustang PandaThe article identifies Mustang Panda as another name for HoneyMyte, which it attributes to the CoolClient cyber-espionage activity and the Myanmar PlugX-to-CoolClient deployment.
Malware
CoolClientCoolClient is a HoneyMyte (Mustang Panda) backdoor that has evolved into a kernel-assisted implant with new rootkit-style stealth, process hiding, and protection capabilities.PlugXIt was observed in intrusions across Asia, including Myanmar, Mongolia, Pakistan, and Russia, and continues to follow a PlugX-to-CoolClient deployment chain.TONESHELLThe overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly
Products
Microsoft Defender Antimalware Platform[T1112 ] Modify Registry – The malware adds Microsoft Defender exclusions and writes configuration values used by the driver [‘added both a folder exclusion and a file exclusion’ and ‘updates theMicrosoft Windows[T1543.003 ] Create or Modify System Process: Windows Service – CoolClient installs itself as a service and also deploys msagent.sys as a driver service [‘establishes an additional persistence mechanism by installing
Countries
MongoliaIt was observed in intrusions across Asia, including Myanmar, Mongolia, Pakistan, and Russia, and continues to follow a PlugX-to-CoolClient deployment chain.MyanmarIt was observed in intrusions across Asia, including Myanmar, Mongolia, Pakistan, and Russia, and continues to follow a PlugX-to-CoolClient deployment chain.PakistanIt was observed in intrusions across Asia, including Myanmar, Mongolia, Pakistan, and Russia, and continues to follow a PlugX-to-CoolClient deployment chain.RussiaIt was observed in intrusions across Asia, including Myanmar, Mongolia, Pakistan, and Russia, and continues to follow a PlugX-to-CoolClient deployment chain.