HoneyMyte adds kernel rootkit to CoolClient
HoneyMyte, the APT group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, according to Kaspersky GReAT research published 14 August 2026.
The new component, a driver named msagent.sys, gives the backdoor deeper persistence and process-hiding capabilities on Windows targets. It sits alongside the existing CoolClient components and extends the malware’s stealth beyond what earlier variants provided.
In the observed campaign, HoneyMyte used PlugX as the initial post-compromise implant to deploy the CoolClient components. Before dropping the malware, the actor added both a folder exclusion and a file exclusion to Microsoft Defender for a fake Windows driver. The driver registers a DriverUnload routine to release allocated resources when it is unloaded.
Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. CoolClient was consistently deployed as a secondary backdoor following PlugX infection, consistent with the group’s previous campaign pattern.
How the rootkit works
The new component, msagent.sys, is a kernel-mode driver that hooks Nsiproxy to filter network traffic. It sits in the kernel to intercept and manipulate data before it reaches user-mode consumers, giving the backdoor a direct path to filter C2 traffic and other selected network information.
On unload, the driver registers a DriverUnload routine that releases the resources it allocated during initialization. This ensures the kernel memory and hooked structures are freed cleanly when the driver is removed from the system, rather than leaking on unload.
Deployment chain: PlugX to CoolClient
In the observed campaign, HoneyMyte used PlugX as the initial post-compromise implant to deploy the CoolClient components. Before dropping the malware, the actor added both a folder exclusion and a file exclusion to Microsoft Defender for a fake Windows driver. The driver registers a DriverUnload routine to release allocated resources when it is unloaded.
CoolClient was consistently deployed as a secondary backdoor following PlugX infection, consistent with the group’s previous campaign pattern.
Who was hit
Kaspersky GReAT identified victims in four countries: Myanmar, Mongolia, Pakistan, and Russia. The campaign targeted government entities, which Kaspersky confirmed in its 14 August 2026 research. The group’s prior activity has focused on organizations across Asia and Russia, and this round fits that pattern.
In the observed intrusions, CoolClient was consistently deployed as a secondary backdoor after PlugX established the initial foothold. That sequencing matches HoneyMyte’s previous campaign structure, where PlugX handles early post-exploitation work before the actor transitions to CoolClient for the main backdoor payload.
Attribution and signing
Kaspersky GReAT confirmed the new msagent.sys driver is digitally signed with an expired certificate, a pattern the group has used in prior kernel-mode components. The signature provides enough trust to pass Windows driver loading checks, but the certificate’s expiry means the driver no longer validates against a current root chain.
The execution flow in this sample matches previously documented CoolClient variants. The kernel-mode driver hooks Nsiproxy to filter network traffic before it reaches user-mode consumers, giving the backdoor a direct path to intercept and manipulate C2 traffic and other selected network data. This is the same hooking approach HoneyMyte has used in earlier CoolClient builds, but the driver now sits in kernel space to hide and protect processes, files, and registry objects.
The deployment chain follows the group’s established pattern: PlugX lands first as the initial post-compromise implant, then drops the CoolClient components. Before the driver is written to disk, the actor adds both a folder exclusion and a file exclusion to Microsoft Defender for the fake Windows driver. This sequencing—PlugX for early post-exploitation, then CoolClient for the main backdoor—matches previous HoneyMyte campaigns and reinforces the attribution.
Key points
- New kernel-mode driver Msagent.sys added to CoolClient backdoor for process, file, and registry hiding plus network data filtering.
- Driver registers a DriverUnload routine and hooks Nsiproxy for C2 traffic filtering.
- Deployed as secondary backdoor after PlugX initial implant in observed campaigns.
- Victims confirmed in Myanmar, Mongolia, Pakistan, and Russia, including government entities.
- Driver signed with an expired certificate; added to Defender exclusions before deployment.