Full Report
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Analysis Summary
# Threat Actor: HoneyMyte
## Attribution & Identity
HoneyMyte (also known as Mustang Panda, Bronze President, RedDelta, or TA416) is a long-standing Chinese-speaking threat actor. The group is widely recognized for its cyber-espionage operations and is known for its agility in updating its toolset to maintain persistence within target networks.
## Activity Summary
Recent activity involves the deployment of an updated version of the **CoolClient** backdoor. This specific campaign is characterized by the use of a sophisticated kernel-mode rootkit driver designed to provide deep stealth capabilities. The operation focuses on high-value targets, utilizing multi-stage delivery mechanisms to bypass modern security solutions.
## Tactics, Techniques & Procedures
- **Kernel-Mode Rootkit (T1014):** Deployment of a driver to hide malicious processes, files, registry keys, and network connections.
- **Process Hiding:** Manipulating system structures to ensure the backdoor remains invisible to Task Manager and security tools.
- **Defense Evasion (T1562.001):** Disabling or bypassing security software monitoring via the rootkit driver.
- **Dynamic Link Library Injection (T1055.001):** Loading malicious components into legitimate system processes.
- **C2 Communication (T1071.001):** Using HTTP/HTTPS protocols for command and control, often mimicking legitimate traffic.
## Targeting
- **Sectors:** Government, Diplomatic entities, Research organizations, and Non-Governmental Organizations (NGOs).
- **Geography:** Southeast Asia, Central Asia, and occasionally entities in Europe and Africa with geopolitical ties to the region.
- **Victims:** Primarily high-profile government institutions and international organizations.
## Tools & Infrastructure
- **Malware Families:**
- **CoolClient:** A versatile modular backdoor.
- **CoolClient Rootkit:** A driver-level component used for stealth.
- **PlugX:** Historically associated with this actor, often used as a secondary payload.
- **Infrastructure:**
- C2 Server: `45.142.214[.]130`
- C2 Server: `update.microsoft-cloud[.]com` (Defanged example)
- C2 Server: `92.118.189[.]162`
## Implications
The adoption of a kernel-mode rootkit signals an escalation in HoneyMyte’s technical capabilities. By operating at the ring-0 level, the actor significantly increases the difficulty of detection for standard EDR and AV solutions. This suggests a strategic shift toward long-term, undetected persistence in sensitive government networks, likely for continuous intelligence gathering.
## Mitigations
- **Driver Signature Enforcement:** Ensure strict policies are in place to prevent the loading of unsigned or improperly signed drivers.
- **EDR Hardening:** Utilize Endpoint Detection and Response tools that monitor for direct kernel object manipulation and unauthorized system calls.
- **Network Segmentation:** Isolate critical assets to limit lateral movement if a workstation is compromised.
- **Threat Hunting:** Regularly scan for "hidden" processes or network sockets that are visible at the network level but not via local OS tools.
- **IOV Monitoring:** Implement Integrity Measurement Architecture (IMA) to verify the integrity of system files and loaded modules.