--- title: "CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit" url: https://daily.dev/posts/coolclient-backdoor-goes-deeper-honeymyte-adds-windows-kernel-rootkit-dynia42ty source_url: https://securelist.com/honeymyte-coolclient-driver-rootkit/121028 type: article source: "Securelist" published: 2026-08-14T09:04:17.852Z updated: 2026-08-14T09:04:49.815Z tags: ["malware"] reading_time: 20 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit **[Securelist](https://daily.dev/sources/securelist)** · 20 min read · 0 upvotes · 0 comments ## Summary HoneyMyte (Mustang Panda) has upgraded its CoolClient backdoor with a signed kernel-mode driver (msagent.sys) that adds rootkit capabilities, hiding malicious processes, files, registry entries, and network connections from security tools. Deployed via PlugX post-compromise across Myanmar, Mongolia, Pakistan, and Russia, the driver communicates with the user-mode implant through 33 IOCTL handlers, uses a filesystem minifilter, registry callbacks, process/object callbacks, and hooks Nsiproxy to filter C2 IP addresses from network queries. The driver reuses design elements previously seen in HoneyMyte's ToneShell rootkit and is signed with an old stolen/leaked certificate from Nanjing Ranyi Technology Co., Ltd. valid from 2013-2014. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the CoolClient malware driver hide processes from Windows using its rootkit? The msagent.sys kernel driver hides processes by dynamically locating the ActiveProcessLinks field in the EPROCESS structure and unlinking entries from the Windows active process list via IOCTL 0x22219C, with 0x2221A0 used to restore hidden processes. It also uses object callbacks (ObRegisterCallbacks) to strip access rights from handles opened to protected processes like the injected code in synchost.exe. _Security teams tracking rootkit evasion techniques can follow deep technical breakdowns like this on daily.dev._ ### What is the CoolClient backdoor and which threat actor uses it? CoolClient is a backdoor family attributed to the HoneyMyte APT group, also known as Mustang Panda, used in cyber-espionage campaigns targeting organizations in Asia and Russia. It supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions, and was first publicly disclosed by Sophos in 2022 with further analysis by Trend Micro in 2023. _Analysts researching APT toolsets can keep up with backdoor family updates like CoolClient on daily.dev._ ### How does the CoolClient driver hide its C2 server's IP address from network monitoring tools? The driver hooks the Nsiproxy driver by obtaining a reference to \Driver\Nsiproxy via ObReferenceObjectByName and replacing one of its handler pointers with a custom filtering routine. When network information is queried, the hook compares returned entries against a registered C2 IPv4 address list (set via IOCTL 0x2221E0) and strips matching addresses before returning results to user mode. _Incident responders investigating network-hiding rootkits can track techniques like this through daily.dev._ ## Similar posts on daily.dev - [HoneyMyte updates CoolClient backdoor, uses new data stealing tools](https://daily.dev/posts/honeymyte-updates-coolclient-backdoor-uses-new-data-stealing-tools-krpqq5jlu) · Securelist · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/coolclient-backdoor-goes-deeper-honeymyte-adds-windows-kernel-rootkit-dynia42ty)