The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with browser login stealers and advanced surveillance tools.
This evolution targets government entities in Southeast Asia, Myanmar, Mongolia, Malaysia, Russia, Thailand, and Pakistan.
HoneyMyte focuses on espionage in Asia and Europe, hitting government targets hardest. The group deploys tools like ToneShell rootkit, PlugX, QReverse, CoolClient backdoors, and USB worms such as Tonedisk.
In 2025, they enhanced CoolClient with browser credential theft, data exfiltration scripts, and reconnaissance features. Full IOCs and details are in Kaspersky’s Intelligence Reporting Service.
CoolClient Backdoor Evolution
Sophos spotted early CoolClient in 2022; Trend Micro analyzed an update in 2023. Recent variants appear in multi-stage infections alongside PlugX and LuminousMoth.
Delivery uses encrypted loaders with DLL sideloading via signed binaries from BitDefender, VLC, Ulead PhotoImpact, and Sangfor apps (2021-2025).
The latest version abuses Sangfor’s Sang.exe to load libngs.dll, which decrypts loader.dat, time.dat, and main.dat. These hold shellcode and DLLs for injection into write.exe processes.
| File | Description |
|---|---|
| Sang.exe | Legitimate binary for DLL sideloading |
| libngs.dll | Decrypts and executes loader.dat shellcode |
| loader.dat | Shellcode, parameter checker, process injection |
| time.dat | Encrypted config |
| main.dat | Core functionality DLL |
Execution and Persistence
CoolClient uses parameters like “install,” “work,” and “passuac”:
- install: Sets Run key persistence, injects loader.dat, checks AV (e.g., 360sd.exe), installs “media_updaten” service, bypasses UAC.
- work: Injects into write.exe.
- passuac: Spoofs svchost.exe, creates ComboxResetTask, elevates via token duplication.
The final DLL enables keylogging, TCP tunneling, reverse proxy, file ops, plus new clipboard monitoring (using GetClipboardData/GetWindowTextW) and HTTP proxy credential sniffing from traffic, as reported by Securelist.
Plugins Expand Capabilities
CoolClient stages plugins via C2:
| Plugin | Functions |
|---|---|
| ServiceMgrS.dll | Enumerate/start/stop/create/delete services |
| FileMgrS.dll | List drives/files, delete/create/move, ZIP, execute, search |
| RemoteShellS.dll | Hidden cmd.exe with I/O redirection to C2 |
C2 uses TCP/UDP with magic values (e.g., 0xFFAABBCC for beaconing).
Browser Login Data Stealer
Post-exploitation, HoneyMyte deploys stealers after ToneShell/ QReverse:
| Variant | Target | Method | MD5 |
|---|---|---|---|
| A | Chrome | PE32 | 1A5A9C013CE1B65ABC75D809A25D36A7 |
| B | Edge | PE32 | E1B7EF0F3AC0A0A64F86E220F362B149 |
| C | Chromium | DLL sideloading | DA6F89F15094FD3F74BA186954BE6B05 |
Variant C copies Login Data/Local State, queries SQLite for credentials, decrypts via DPAPI/AES, outputs to License.txt. Linked to LuminousMoth via code reuse.
Scripts aid theft:
- 1.bat: Downloads curl/rar/nbtscan, profiles system, exfils via FTP.
- Ttraazcs32.ps1: Collects docs (doc/xls/pdf, <60 days), RARs, uploads.
- t.ps1: Decrypts Chrome keys, exfils to Pixeldrain.
Monitor for DLL sideloading, Sangfor abuse, services like media_updaten, and C2s (account.hamsterxnxx[.]com).
Defend with behavior detection, DPAPI monitoring, script controls, and network traffic analysis.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
