HoneyMyte (Mustang Panda) has upgraded its CoolClient backdoor with a signed kernel-mode driver (msagent.sys) that adds rootkit capabilities, hiding malicious processes, files, registry entries, and network connections from security tools. Deployed via PlugX post-compromise across Myanmar, Mongolia, Pakistan, and Russia, the driver communicates with the user-mode implant through 33 IOCTL handlers, uses a filesystem minifilter, registry callbacks, process/object callbacks, and hooks Nsiproxy to filter C2 IP addresses from network queries. The driver reuses design elements previously seen in HoneyMyte's ToneShell rootkit and is signed with an old stolen/leaked certificate from Nanjing Ranyi Technology Co., Ltd. valid from 2013-2014.
Questions this post answers
How does the CoolClient malware driver hide processes from Windows using its rootkit?
The msagent.sys kernel driver hides processes by dynamically locating the ActiveProcessLinks field in the EPROCESS structure and unlinking entries from the Windows active process list via IOCTL 0x22219C, with 0x2221A0 used to restore hidden processes. It also uses object callbacks (ObRegisterCallbacks) to strip access rights from handles opened to protected processes like the injected code in synchost.exe. Security teams tracking rootkit evasion techniques can follow deep technical breakdowns like this on daily.dev.
What is the CoolClient backdoor and which threat actor uses it?
CoolClient is a backdoor family attributed to the HoneyMyte APT group, also known as Mustang Panda, used in cyber-espionage campaigns targeting organizations in Asia and Russia. It supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions, and was first publicly disclosed by Sophos in 2022 with further analysis by Trend Micro in 2023. Analysts researching APT toolsets can keep up with backdoor family updates like CoolClient on daily.dev.
How does the CoolClient driver hide its C2 server's IP address from network monitoring tools?
The driver hooks the Nsiproxy driver by obtaining a reference to \Driver\Nsiproxy via ObReferenceObjectByName and replacing one of its handler pointers with a custom filtering routine. When network information is queried, the hook compares returned entries against a registered C2 IPv4 address list (set via IOCTL 0x2221E0) and strips matching addresses before returning results to user mode. Incident responders investigating network-hiding rootkits can track techniques like this through daily.dev.