HoneyMyte updates CoolClient with a signed kernel driver to hide processes and protect the C2 channel

Kaspersky has published an analysis that attributes to the actor known as HoneyMyte (also Mustang Panda) an updated version of the CoolClient backdoor that incorporates a signed kernel component capable of hiding and protecting processes, files, registry entries and information related to the command and control channel (C2). Done confirmed: the driver's signature appears in the name of Nanjing Ranyi Technology Co., Ltd. and the malicious package was observed in attacks on organizations in Myanmar, Mongolia, Pakistan and Russia, including government entities, according to the security firm.

From the technical point of view, the sample documented by Kaspersky shows an architecture in several stages: an initial charger (usually PlugX in the observed campaigns) delivers a chain that abuses DLL sideloading and programmed tasks to achieve persistence in SYSTEM; a second stage called loadcert.ini is responsible for raising privileges, deploying the kernel driver (msagent.sys) when the process has access to the Service Control Manager and the SeTcbPrivilege privilege, and finally loading the backdoor cert.ini that maintains communication with the C2 servers. Done confirmed: The driver is installed as a service (msagent) and communicates with the component in user space by means of IOCTL calls.

The kernel rootkit extends the CoolClient's escape capacity in several ways: it records processes such as "reliable" to allow them privileged access to protected objects; it injects its code into processes such as synchost.exe and reduces permissions by opening handles on protected processes to block termination or injection; it hides entries from the active process list; it filters network information to remove C2 addresses from user space queries; and it uses a file system and registration callbacks mini-filter to prevent inspection or deletion of artifacts. Kaspersky identified three IOCTL used in normal execution (0x222120, 0x2221E0, 0x2220F0) but the driver contains 33 total handlers, suggesting additional functionality available but not observed in that particular sample.

Practical implications: the presence of a signed and designed driver to protect malicious components complicates detection and mediation. An actor with access to SCM and high-level privileges can install and boot a driver that restores or blocks malware removal, hides traces of exfiltration and guarantees persistence between restarts. For government organizations and critical networks, this increases the risk of sustained espionage and theft of credentials and data, as well as making forensic response difficult.

There are confirmed aspects and others that remain estimates or subject to verification. Confirmed: Kaspersky published associated hashes, routes and C2 domains and documented the execution chain in at least one campaign in Myanmar where PlugX acts as an entry point and creates a false Windows Defender folder to evade scanning. Dear or uncertain: the link between old drivers signed with the same certificate (compiled around 2013) and current activity is not proven; Kaspersky did not find direct evidence to connect these old binaries to recent operations, although the reuse of the certificate raises questions about historical commitment or use of stolen signatures.

If you manage Windows systems or are part of the security team, there are concrete and verifiable measures you should take right now. First, detect compromise indicators: check the presence of msagent.sys and the hashes published by Kaspersky, examine new services with suspicious names (e.g. msagent or half _ update), and look for programmed tasks and exclusions in Microsoft Defender that point to unusual directories. Use Microsoft and Sysinternals tools to audit drivers and services (e.g. sc query, driver, fltmc, Autouns and Process Explorer). A useful command to review Defense exclusions from PowerShell is Get-MpPreference, which shows configured exclusions.

Second, limit driver installation and service creation capabilities: apply device control policies and sign drivers in kernel mode (Windows imposes strict requirements, see more in Microsoft's documentation on driver code signing), and restrict SeTcbPrivilege privilege to the accounts that really require it. The policy of signing drivers and the administration of the Service Control Manager ( SCM documentation) are useful resources for setting up technical defences and reviewing configurations.

Third, if you detect signs of commitment: isolate the affected equipment from the network, preserve memory and disk dumping for forensic analysis before reboot, and coordinate with an incident response team. Removing a malicious driver that implements protections may require advanced techniques (e.g. safe start or from an external environment) and monitoring of kernel and mini-filter callbacks. If you have no internal experience, contact incident response providers or your antivirus provider for specialized assistance.

Finally, take preventive measures: rigorously apply patches and updates, minimize the use of permanent administrative privileges, control the installation of software with integrity / whitelisting and review safety tools to detect suspicious or renowned exclusions. Kaspersky already published IoC and hashes that should be incorporated into lock lists and search processes in his organization; doing retroactive searches on telemetry will help to identify possible previous commitments.

In short, the main novelty that Kaspersky documents is the incorporation of a Kernel driver signed which expands CoolClient's hiding and protection capabilities, which complicates detection and mediation. While the evidence points to specific campaigns in Asia and Russia and a consistent pattern of deployment after PlugX, they remain untold about the certificate history and the full use of the 33 IOCTLs implemented. Organizations should treat this variant as a serious threat to persistence and exfiltration, and prioritize IoC-based detection, restriction of privileges and forensic response procedures to mitigate it.