HoneyMyte adds kernel rootkit to CoolClient
HoneyMyte, the APT group also known as Mustang Panda, has upgraded its CoolClient backdoor with a Windows kernel-mode rootkit, according to Kaspersky GReAT research published on 14 August 2026.
The new component is a driver named msagent.sys. Kaspersky says the design is comparable to the kernel-mode enhancements it previously observed in HoneyMyte's ToneShell backdoor.
Kaspersky identified victims in Myanmar, Mongolia, Pakistan and Russia, including confirmed government entities.
How the rootkit works
The driver is written to disk as msagent.sys and loaded as a service named msagent. It is signed, but with a certificate that was valid only from August 2013 to September 2014.
Once loaded, the driver:
- hides the CoolClient process, including by unlinking processes from the active process list, and hides kernel modules;
- uses a minifilter to deny access to protected file paths;
- uses a registry callback to hide or block access to protected keys and values;
- hooks Nsiproxy so that matching C2 IP addresses are removed from network data before it is returned to user mode.
The driver also registers a DriverUnload routine to release its resources when it is unloaded.
Deployment chain: PlugX to CoolClient
In the Myanmar campaign, HoneyMyte used PlugX as the initial post-compromise implant, which then deployed the CoolClient components. Kaspersky says CoolClient was consistently deployed as a secondary backdoor after PlugX infections.
Before deploying the malware, the actor used wmic against the MSFT_MpPreference class to add a folder exclusion and a file exclusion to Microsoft Defender. The folder exclusion covers a fake Defender folder, and the file exclusion covers the sideloading executable, a renamed Sangfor binary (Sang.exe, renamed to defender.exe).
Key points
- HoneyMyte has added a kernel-mode driver, msagent.sys, to its CoolClient backdoor.
- The driver hides processes and kernel modules, protects files and registry entries, and filters C2 addresses through an Nsiproxy hook.
- It is loaded as the service msagent and is signed with a certificate that expired in September 2014.
- PlugX was used as the initial implant and deployed CoolClient as a secondary backdoor.
- Before deployment the actor added Defender exclusions for a fake Defender folder and a renamed Sangfor sideloader.
- Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.
Further reading & sources
- CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit | Securelist — Kaspersky Securelist