Mustang Panda Adds Signed Windows Rootkit to Cool Client Backdoor for Stealth
Summary: Kaspersky found an updated CoolClient backdoor from the HoneyMyte (Mustang Panda) group that installs a signed Windows kernel-mode rootkit, with victims identified in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. The driver, written to disk as msagent.sys and signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. valid from August 2013 to September 2014, hides and protects processes, files, registry objects, and C2 network information, and is deployed only when CoolClient has full access to the Service Control Manager and the SeTcbPrivilege privilege.
Bottom line: A signed kernel driver that unlinks processes from the active process list, filters C2 addresses out of network data returned to user mode, and blocks termination and code injection defeats the user-mode tools most teams rely on to see and stop an intrusion. Kaspersky observed only three of the driver's 33 IOCTL handlers in use, leaving the rest available to the actor.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026