HoneyMyte CoolClient Rootkit Hooks Windows Nsiproxy to Conceal C2 Addresses

The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode rootkit that hides command-and-control (C2) infrastructure on compromised Windows systems.

The new capability marks a major shift for the malware, which was previously known mainly as a user-mode espionage tool. CoolClient has been linked to HoneyMyte campaigns targeting organizations across Asia and Russia.

The backdoor supports keylogging, clipboard theft, credential harvesting, file operations, system reconnaissance, and plugin-based expansion. Recent attacks were observed in Myanmar, Mongolia, Pakistan, and Russia, including against government entities.

Researchers found that HoneyMyte often uses PlugX as the initial implant after a breach. PlugX then helps deploy CoolClient and its supporting files.

Before installing the malware, the attackers add Microsoft Defender exclusions for a fake Windows Defender directory and a renamed executable called defender.exe.

The attackers copy files into a directory such as C:\Program Files\Microsoft\Windows Defender\ to make the installation look legitimate.

They also abuse a valid Sangfor application, typically Sang.exe, rename it as defender.exe, and use it for DLL sideloading. When launched, the trusted program loads a malicious DLL named libngs.dll.

CoolClient creates persistence through a scheduled task and an AutoRun registry entry named goopdate.

The scheduled task can launch the fake Defender executable as SYSTEM during startup. This helps the malware survive reboots and run with high privileges.

HoneyMyte Rootkit Hides C2

The infection uses several components, each with a different role. The legitimate Sangfor program acts as the sideloader, while libngs.dll serves as the first-stage loader. It decrypts the second-stage payload, loadcert.ini, directly in memory.

The second-stage component handles persistence, privilege checks, process injection, driver deployment, and the loading of the final implant, cert.ini.

It injects into a process named synchost.exe, which appears similar to the legitimate Windows svchost.exe process and may avoid casual inspection.

CoolClient can also install itself as a Windows service called media_updaten. It checks whether endpoint software from 360 Total Security is running before following this route.

If it has administrator access, the malware may use an RPC-based UAC bypass technique along with parent process ID spoofing. This makes an elevated CoolClient process appear to have been launched by a trusted Windows program.

After gaining sufficient privileges, CoolClient extracts and installs a signed kernel driver named msagent.sys.

The driver is registered as a service and loaded into the Windows kernel. CoolClient then communicates with it through DeviceIoControl requests, also called IOCTLs.

Three IOCTL commands are central to the observed attack. One registers the CoolClient process as trusted. Another gives the driver the configured C2 IPv4 address. A third sends paths and registry locations that the driver must protect or hide, securelist said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR