The China linked espionage group Kaspersky tracks as HoneyMyte, better known as Mustang Panda, has given one of its long serving backdoors a kernel level upgrade that makes the malware close to invisible on an infected Windows machine.
Writing on Securelist, researcher Fareed Radzi describes a new version of the group's CoolClient backdoor that now ships with its own signed Windows driver. Because a driver runs inside the operating system kernel rather than alongside ordinary programs, it can lie to everything above it. This one hides the backdoor's process from task listings, shields its files and registry keys from being read, changed or deleted, and strips the access rights other software needs to open a handle to it, which is the step an antivirus product would have to take before it could kill the process.
Where it has been seen
Kaspersky says it has found the updated CoolClient and its driver in intrusions across several Asian countries, including Pakistan, Mongolia and Myanmar. In the Myanmar case the group used PlugX, its signature implant, as the first post compromise foothold and deployed the CoolClient components from there. CoolClient itself is not new. Sophos documented it publicly in 2022 and Trend Micro analyzed it in 2023, and Kaspersky reported a variant last year that added clipboard theft and HTTP traffic interception for harvesting credentials.
The design echoes kernel mode additions previously seen in ToneShell, another Mustang Panda tool that featured in the group's campaign against Thai targets. What is different here is that the CoolClient driver exposes dedicated IOCTL handlers, a control channel that lets the user mode backdoor talk directly to its kernel component and tell it what to hide.
How the attack works
The chain leans heavily on impersonating Microsoft's own security software. Before dropping anything, the attackers use wmic to add folder and file exclusions to Microsoft Defender for a fake Microsoft Windows Defender directory they are about to create. They then copy CoolClient into that directory and rename a legitimate Sangfor executable to defender.exe, using it to side load a malicious library called libngs.dll. Side loading works because a trusted signed program will load a library sitting next to it, so the attacker's code inherits the good program's reputation.
Persistence is layered: a scheduled task that runs at startup with SYSTEM privileges under a name mimicking Microsoft Defender Advanced Threat Protection, an AutoRun registry value named goopdate, and a Windows service called media_updaten. Before installing that service the malware checks whether 360 Total Security is running and backs off if it is. To reach the privileges it needs, CoolClient abuses an RPC based process creation technique with parent process ID spoofing, so the elevated copy of itself appears to have been launched by a trusted Windows binary rather than by the malware.
Running with administrator rights inside an injected synchost.exe process, it then unpacks a compressed driver, writes it to disk as msagent.sys and loads it as a service. The driver reads its configuration from the registry key HKLM SYSTEM RNG, where values with names such as Wid_H1deF5Dirs and Wid_H1deRegKeys list exactly which folders, files, registry keys and processes it should conceal.
An odd certificate
The driver is signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. that was valid only between August 2013 and September 2014. Kaspersky found older malicious drivers compiled around 2013 carrying the same certificate, but says it found no evidence directly tying those samples to this activity. A leftover build path inside the driver contains Chinese strings referring to a Nanjing laboratory and a developer name, and Kaspersky's open source checks turned up nothing linking them to any known organization.
What to look for
There is no patch to apply here, because this is malware rather than a product flaw, so the artifacts are the useful part: Defender exclusions added through wmic, a Microsoft Windows Defender folder that should not exist, services named media_updaten or msagent, the HKLM SYSTEM RNG configuration key, and the goopdate AutoRun value. Kaspersky's full technical write up carries the complete indicator set.
Selected indicators (MD5)
- 2d7c8780e97409770a9d4f31c66c9d63
- 9460e150e1981d5c165043520c5c12fe
- 9717f005c5fb98e08d2ad983d88f94ee
- f518d8e5fe70d9090f6280c68a95998f
- eb79558b037669792652a816e2c669de
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.