Full Report
The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,
Analysis Summary
# Threat Actor: HoneyMyte (Mustang Panda)
## Attribution & Identity
HoneyMyte is a sophisticated Chinese-speaking threat actor, widely tracked by the security community as **Mustang Panda**. It is associated with targeted espionage operations and is known for its high level of persistence and evolving toolset.
## Activity Summary
Recent activity involves the deployment of an updated version of the **CoolClient** backdoor. In campaigns identified in August 2026, the actor utilized a multi-stage infection chain beginning with **PlugX** to deliver a new kernel-mode rootkit. This rootkit is specifically designed to provide stealth by hiding malicious artifacts from security software and system administrators.
## Tactics, Techniques & Procedures
- **DLL Side-Loading**: Renaming legitimate executables (e.g., Sangfor's binary renamed to `defender.exe`) to load malicious DLLs (`libngs.dll`).
- **Persistence Mechanisms**: Establishing persistence via scheduled tasks and AutoRun registry entries (named `goopdate`).
- **Privilege Escalation**: Utilizing RPC-based process creation and Parent Process ID (PPID) spoofing to relaunch itself with SYSTEM privileges.
- **Rootkit Capabilities**: Deploying a signed kernel-mode driver (`msagent.sys`) to hide files, processes, registry objects, and C2 network information via IOCTL requests.
- **Defense Evasion**: Automatically adding Microsoft Defender exclusions for malicious installation directories.
- **Credential Harvesting**: Stealing credentials, clipboard data, and implementing keylogging.
## Targeting
- **Sectors**: Government entities and public sector organizations.
- **Geography**: Myanmar, Mongolia, Pakistan, and Russia.
- **Victims**: Specifically confirmed government entities in the aforementioned regions.
## Tools & Infrastructure
- **Malware Families**:
- **PlugX**: Initial post-compromise implant.
- **CoolClient**: Modular backdoor (stages: `loadcert.ini` and `cert.ini`).
- **msagent.sys**: Signed Windows kernel-mode rootkit.
- **Infrastructure**:
- **C2**: Communication handled by the `cert.ini` implant.
- **C2 IP/Domains**: Indicators of compromise include the registry path `\REGISTRY\MACHINE\SYSTEM\RNG`. (Specific C2 URLs/IPs were referenced as published by Kaspersky; defang any identified IPs like `127.0.0[.]1` if found in logs).
- **Certificates**: A digital certificate issued to "Nanjing Ranyi Technology Co., Ltd." (valid 2013-2014) used to sign the rootkit.
## Implications
The addition of a signed kernel-mode rootkit marks a significant escalation in HoneyMyte’s technical capabilities. By moving into the Windows kernel, the actor can bypass standard user-mode security hooks, making detection and remediation extremely difficult for traditional EDR and AV solutions. The continued targeting of Russian and Southeast Asian government entities underscores their strategic focus on regional espionage.
## Mitigations
- **Kernel Mode Code Signing**: Monitor for the installation of new drivers and verify certificates against known malicious or revoked publishers (e.g., Nanjing Ranyi Technology).
- **Endpoint Detection**: Implement EDR rules to detect PPID spoofing and RPC-based process creation patterns.
- **File Integrity Monitoring**: Monitor for the creation of unusual `.sys` files in `C:\Windows\System32\drivers\` and unexpected modifications to Microsoft Defender exclusion lists.
- **Privilege Management**: Restrict the `SeTcbPrivilege` and SCM access to prevent the deployment of kernel components by non-authorized services.
- **Threat Hunting**: Search for registry keys under `HKLM\SYSTEM\RNG` and services named `media_updaten` or `msagent`.