Mustang Panda CoolClient: When a Backdoor Moves Into the Windows Kernel

Mustang Panda has pushed the Mustang Panda CoolClient backdoor deeper into Windows. Kaspersky identified a newer variant that can deploy a kernel-mode rootkit, giving the malware mechanisms to conceal and protect malicious processes, files, registry objects, and selected network information.

The change matters because the operation no longer relies solely on user-mode components for post-compromise activity. When the required privileges exist, CoolClient can load a malicious kernel-mode driver that gives the malware deeper control over security-sensitive Windows operations.

For enterprise defenders, the incident highlights a difficult endpoint security problem: a compromised system can persist, communicate with an attacker, conceal artifacts, and filter information that analysts may rely on during investigation.

CoolClient crosses the user-mode boundary

CoolClient is not new to HoneyMyte, also tracked as Mustang Panda. The latest variant adds a previously undocumented kernel-mode driver, extending CoolClient beyond user-mode operations.

Kaspersky found Mustang Panda CoolClient deployed after PlugX infections in Myanmar, Mongolia, Pakistan, and Russia, including government entities. PlugX acted as the initial post-compromise implant, but the report does not establish how attackers first entered the environments.

In the analyzed Myanmar campaign:

• PlugX created a fake Microsoft Windows Defender directory.
• A legitimate Sangfor executable was renamed to defender.exe for DLL sideloading.
• Microsoft Defender exclusions were added for the malicious directory.
• A scheduled task enabled SYSTEM-level startup.
• CoolClient used registry persistence and could install itself as a Windows service.
• Its second stage injected into synchost.exe before attempting driver deployment.
• If privileges were insufficient, CoolClient skipped the driver and continued to its final-stage implant.

The chain combines DLL sideloading, persistence, privilege elevation, process injection, service creation, and C2 communication. The kernel driver adds another stealth layer by helping conceal or protect malicious artifacts and filtering selected information visible to user-mode processes.

A digital signature does not make a driver trustworthy

The rootkit component, msagent.sys, carries a digital signature. Kaspersky found that the certificate was issued to Nanjing Ranyi Technology Co., Ltd. and was valid from August 2013 to September 2014. The case illustrates signed driver abuse: a digital signature alone does not establish that kernel code is trustworthy.

CoolClient loads the driver only when specific privilege conditions are met. It checks for full access to the Windows Service Control Manager and the presence of SeTcbPrivilege. If either requirement is missing, the malware can skip kernel-driver deployment and continue its later-stage execution.

When those requirements are satisfied:

• The injected second-stage payload (loadcert.ini) extracts the embedded LZMA-compressed driver file to disk as msagent.sys.
• It writes the component to disk as msagent.sys.
• It removes an existing msagent service if present.
• It creates and starts a new driver service.
• The loaded driver reads stealth configuration from the Windows registry.

Those privilege requirements place the HoneyMyte rootkit in the post-compromise phase, where CoolClient uses kernel access to strengthen stealth and defense evasion.

The rootkit tries to distort the defender’s view

The Windows kernel rootkit helps CoolClient conceal and protect malicious activity, making endpoint investigation harder.

Kaspersky found that the driver uses callbacks and filtering mechanisms across filesystem, registry, process, object, and image-load activity. CoolClient communicates with it through IOCTL requests, while the driver can filter configured C2-related addresses from network information returned to user mode.

For defenders, missing artifacts in normal user-mode views do not necessarily mean they are absent.

These signals do not independently confirm Mustang Panda CoolClient. Teams should correlate them with process activity, file hashes, services, execution paths, and network indicators.

The defensive problem starts before the rootkit loads

Kernel monitoring matters, but preventing attackers from reaching the required privilege state matters just as much.

The rootkit depends on a Windows endpoint that has already reached a significant level of compromise. That makes Windows hardening and privilege governance important layers even though they cannot eliminate every post-compromise technique.

Security teams should focus on:

• Limiting administrative access and unnecessary privileges.
• Investigating unexpected service and driver installation.
• Monitoring scheduled-task creation and suspicious registry changes.
• Reviewing DLL loads involving legitimate applications from abnormal paths.
• Correlating process injection with surrounding file and network activity.
• Maintaining current operating systems and applications through disciplined patching.
• Treating unexpected signed drivers as investigation candidates rather than automatically trusted software.

This is especially relevant for nation-state malware, where operators can combine familiar techniques rather than depend on one conspicuous exploit or executable.

Featured resource

Introduction to Hexnode XDR

Hexnode XDR unifies threat visibility, investigation, correlation, and remediation to strengthen enterprise endpoint security operations.

DOWNLOAD

Where Hexnode can support the response workflow

The Mustang Panda CoolClient campaign shows the need to combine endpoint management with security telemetry. Hexnode can support this workflow, but it does not replace broader threat intelligence or incident response.

Hexnode XDR can help teams:

• Investigate process, file, and network activity.
• Correlate endpoint telemetry.
• Terminate malicious processes.
• Quarantine files.
• Isolate affected endpoints.

These capabilities can support investigation and containment, but they do not mean Hexnode specifically detects CoolClient or every rootkit technique.

Hexnode UEM can complement this with:

• Windows OS and application updates.
• Device restrictions.
• Application blocklisting and allowlisting.
• Application Compliance monitoring.

For example, application allowlisting can prevent unauthorized or renamed binaries (such as the spoofed defender.exe executable) from running out of non-standard directories, neutralizing the initial DLL sideloading vector.

Conclusion

The Mustang Panda CoolClient update shows why a trusted-looking component should not automatically be treated as trustworthy. A signed driver can form part of a malicious post-compromise chain, while kernel-level concealment can make endpoint investigation more difficult.

Enterprises should prioritize privilege control, driver scrutiny, endpoint telemetry, and rapid containment. Earlier detection of activity preceding kernel deployment can help teams contain affected endpoints before rootkit-based concealment complicates investigation.