[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwLfIo2JWBuZ-nAcXxDJAvp5zVB2zJa3ISudLyuqMp4I":3,"$fCb2KajQczVCZ7ojpuu9Kd7g-PyIAGbzn1QYakkU627M":43},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":39,"created_at":40,"updated_at":41,"published_at":42},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","New msagent.sys driver hides the CoolClient process, protects its files and registry entries, and filters C2 addresses from network data.","Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.",[10,11,12,13,14,15],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","APT","# HoneyMyte adds kernel-mode rootkit to CoolClient backdoor\n\n*New msagent.sys driver hides the CoolClient process, protects its files and registry entries, and filters C2 addresses from network data.*\n\n**Tags:** `HoneyMyte` `Mustang Panda` `CoolClient` `Msagent.sys` `Windows kernel rootkit` `APT`\n\n> Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.\n\n---\n\n## HoneyMyte adds kernel rootkit to CoolClient\n\nHoneyMyte, the APT group also known as Mustang Panda, has upgraded its CoolClient backdoor with a Windows kernel-mode rootkit, according to Kaspersky GReAT research published on 14 August 2026.\n\nThe new component is a driver named msagent.sys. Kaspersky says the design is comparable to the kernel-mode enhancements it previously observed in HoneyMyte's ToneShell backdoor.\n\nKaspersky identified victims in Myanmar, Mongolia, Pakistan and Russia, including confirmed government entities.\n\n## How the rootkit works\n\nThe driver is written to disk as msagent.sys and loaded as a service named msagent. It is signed, but with a certificate that was valid only from August 2013 to September 2014.\n\nOnce loaded, the driver:\n\n- hides the CoolClient process, including by unlinking processes from the active process list, and hides kernel modules;\n- uses a minifilter to deny access to protected file paths;\n- uses a registry callback to hide or block access to protected keys and values;\n- hooks Nsiproxy so that matching C2 IP addresses are removed from network data before it is returned to user mode.\n\nThe driver also registers a DriverUnload routine to release its resources when it is unloaded.\n\n## Deployment chain: PlugX to CoolClient\n\nIn the Myanmar campaign, HoneyMyte used PlugX as the initial post-compromise implant, which then deployed the CoolClient components. Kaspersky says CoolClient was consistently deployed as a secondary backdoor after PlugX infections.\n\nBefore deploying the malware, the actor used wmic against the MSFT_MpPreference class to add a folder exclusion and a file exclusion to Microsoft Defender. The folder exclusion covers a fake Defender folder, and the file exclusion covers the sideloading executable, a renamed Sangfor binary (Sang.exe, renamed to defender.exe).\n\n## Key points\n\n- HoneyMyte has added a kernel-mode driver, msagent.sys, to its CoolClient backdoor.\n- The driver hides processes and kernel modules, protects files and registry entries, and filters C2 addresses through an Nsiproxy hook.\n- It is loaded as the service msagent and is signed with a certificate that expired in September 2014.\n- PlugX was used as the initial implant and deployed CoolClient as a secondary backdoor.\n- Before deployment the actor added Defender exclusions for a fake Defender folder and a renamed Sangfor sideloader.\n- Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.\n\n## Further reading & sources\n\n- [CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit | Securelist](https:\u002F\u002Fsecurelist.com\u002Fhoneymyte-coolclient-driver-rootkit\u002F121028) — Kaspersky Securelist","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5",{"iocs":19,"actors":23,"malware":30,"technologies":35},[20],{"type":21,"value":22},"other","msagent.sys",[24],{"url":25,"name":11,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fmustang-panda","mustang-panda","apt","China (PRC state-sponsored; court documents say the PRC government paid the group)","espionage",[31,32,34],{"name":22},{"name":33},"PlugX",{"name":12},[36],{"vendor":37,"product":38},"Microsoft","Windows","threat_actor_activity","2026-08-29T12:13:55.8896+00:00","2026-10-16T12:29:04.072979+00:00",null,{"articles":44},[45,57,69,82],{"slug":46,"title":47,"summary":48,"tags":49,"hero_image_url":55,"story_type":39,"created_at":56},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[50,51,52,15,53,54],"Armored Likho","BusySnake Stealer","Kaspersky","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":58,"title":59,"summary":60,"tags":61,"hero_image_url":66,"story_type":67,"created_at":68},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[62,63,64,65,15],"Head Mare","TrueConf","PhantomCore","PhantomGraph","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","campaign","2026-08-28T17:23:49.323621+00:00",{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":80,"story_type":39,"created_at":81},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[74,75,76,77,78,79],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":93,"story_type":39,"created_at":94},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[87,88,89,90,91,92],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00"]