HoneyMyte APT Group Enhances CoolClient with Kernel-Level Rootkit Functionality

The HoneyMyte APT group, also known as Mustang Panda, has made significant upgrades to its CoolClient backdoor, which has been employed in cyber-espionage operations targeting organizations in Asia and Russia. This latest variant introduces a kernel-mode rootkit driver that enhances the malware's ability to conceal its presence by hiding processes, files, and network connections from security tools and analysts.

Since its initial disclosure by Sophos in 2022 and further analysis by Trend Micro in 2023, CoolClient has evolved to include features such as clipboard theft and credential harvesting. The most recent analysis reveals that the updated CoolClient variant can deploy a signed kernel-mode driver as a Windows service, communicating through IOCTL requests. This driver significantly increases the malware's stealth capabilities, allowing it to protect its processes and files from inspection.

In late 2025 and early 2026, researchers observed this new variant in various intrusions across Asia, including Pakistan, Mongolia, and Myanmar. In one campaign targeting Myanmar, HoneyMyte utilized PlugX as an initial implant to deploy the CoolClient components. The attackers created a fake Windows Defender installation directory and renamed a legitimate executable to disguise their malicious activities.

The execution process begins when the legitimate application loads the malicious DLL through DLL sideloading. The malware employs various techniques to appear legitimate, including exporting dummy functions that serve no purpose other than to mimic expected behavior. The actual malicious logic is executed from the DllMain entry point, which is heavily obfuscated.

The CoolClient variant follows a multi-stage execution chain, with each component playing a specific role. The loader prepares the execution environment and establishes persistence through registry modifications and scheduled tasks. If the malware is executed with the install parameter, it creates an AutoRun entry to ensure it runs at user logon.

The kernel-mode driver is deployed if the malware has sufficient privileges, allowing it to hide its files and processes effectively. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd., and its initialization routine loads configuration settings from the registry to determine which objects to protect.

The driver employs advanced techniques to maintain compatibility across different Windows versions and utilizes IOCTL requests to register the CoolClient process as a trusted entity. This allows the malware to interact with protected files and processes without detection.

Overall, the enhancements to the CoolClient backdoor illustrate the ongoing evolution of cyber-espionage tools and the increasing sophistication of APT groups like HoneyMyte. The use of kernel-mode drivers and advanced evasion techniques poses significant challenges for cybersecurity defenses, highlighting the need for continuous vigilance and adaptation in the face of evolving threats.