[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwLfIo2JWBuZ-nAcXxDJAvp5zVB2zJa3ISudLyuqMp4I":3,"$fCb2KajQczVCZ7ojpuu9Kd7g-PyIAGbzn1QYakkU627M":43},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":39,"created_at":40,"updated_at":41,"published_at":42},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","New Msagent.sys driver hides processes, files, and registry keys in Windows kernel space.","HoneyMyte (Mustang Panda) APT has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, Msagent.sys, that provides process hiding, file hiding, registry hiding, and network data filtering for deeper persistence and stealth in targeted intrusions across Asia and Russia.",[10,11,12,13,14,15],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","APT","# HoneyMyte adds kernel-mode rootkit to CoolClient backdoor\n\n*New Msagent.sys driver hides processes, files, and registry keys in Windows kernel space.*\n\n**Tags:** `HoneyMyte` `Mustang Panda` `CoolClient` `Msagent.sys` `Windows kernel rootkit` `APT`\n\n> HoneyMyte (Mustang Panda) APT has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, Msagent.sys, that provides process hiding, file hiding, registry hiding, and network data filtering for deeper persistence and stealth in targeted intrusions across Asia and Russia.\n\n---\n\n## HoneyMyte adds kernel rootkit to CoolClient\n\nHoneyMyte, the APT group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a new Windows kernel-mode rootkit, according to Kaspersky GReAT research published 14 August 2026.\n\nThe new component, a driver named msagent.sys, gives the backdoor deeper persistence and process-hiding capabilities on Windows targets. It sits alongside the existing CoolClient components and extends the malware’s stealth beyond what earlier variants provided.\n\nIn the observed campaign, HoneyMyte used PlugX as the initial post-compromise implant to deploy the CoolClient components. Before dropping the malware, the actor added both a folder exclusion and a file exclusion to Microsoft Defender for a fake Windows driver. The driver registers a DriverUnload routine to release allocated resources when it is unloaded.\n\nKaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. CoolClient was consistently deployed as a secondary backdoor following PlugX infection, consistent with the group’s previous campaign pattern.\n\n## How the rootkit works\n\nThe new component, msagent.sys, is a kernel-mode driver that hooks Nsiproxy to filter network traffic. It sits in the kernel to intercept and manipulate data before it reaches user-mode consumers, giving the backdoor a direct path to filter C2 traffic and other selected network information.\n\nOn unload, the driver registers a DriverUnload routine that releases the resources it allocated during initialization. This ensures the kernel memory and hooked structures are freed cleanly when the driver is removed from the system, rather than leaking on unload.\n\n## Deployment chain: PlugX to CoolClient\n\nIn the observed campaign, HoneyMyte used PlugX as the initial post-compromise implant to deploy the CoolClient components. Before dropping the malware, the actor added both a folder exclusion and a file exclusion to Microsoft Defender for a fake Windows driver. The driver registers a DriverUnload routine to release allocated resources when it is unloaded.\n\nCoolClient was consistently deployed as a secondary backdoor following PlugX infection, consistent with the group’s previous campaign pattern.\n\n## Who was hit\n\nKaspersky GReAT identified victims in four countries: Myanmar, Mongolia, Pakistan, and Russia. The campaign targeted government entities, which Kaspersky confirmed in its 14 August 2026 research. The group’s prior activity has focused on organizations across Asia and Russia, and this round fits that pattern.\n\nIn the observed intrusions, CoolClient was consistently deployed as a secondary backdoor after PlugX established the initial foothold. That sequencing matches HoneyMyte’s previous campaign structure, where PlugX handles early post-exploitation work before the actor transitions to CoolClient for the main backdoor payload.\n\n## Attribution and signing\n\nKaspersky GReAT confirmed the new `msagent.sys` driver is digitally signed with an expired certificate, a pattern the group has used in prior kernel-mode components. The signature provides enough trust to pass Windows driver loading checks, but the certificate’s expiry means the driver no longer validates against a current root chain.\n\nThe execution flow in this sample matches previously documented CoolClient variants. The kernel-mode driver hooks Nsiproxy to filter network traffic before it reaches user-mode consumers, giving the backdoor a direct path to intercept and manipulate C2 traffic and other selected network data. This is the same hooking approach HoneyMyte has used in earlier CoolClient builds, but the driver now sits in kernel space to hide and protect processes, files, and registry objects.\n\nThe deployment chain follows the group’s established pattern: PlugX lands first as the initial post-compromise implant, then drops the CoolClient components. Before the driver is written to disk, the actor adds both a folder exclusion and a file exclusion to Microsoft Defender for the fake Windows driver. This sequencing—PlugX for early post-exploitation, then CoolClient for the main backdoor—matches previous HoneyMyte campaigns and reinforces the attribution.\n\n## Key points\n\n- New kernel-mode driver Msagent.sys added to CoolClient backdoor for process, file, and registry hiding plus network data filtering.\n- Driver registers a DriverUnload routine and hooks Nsiproxy for C2 traffic filtering.\n- Deployed as secondary backdoor after PlugX initial implant in observed campaigns.\n- Victims confirmed in Myanmar, Mongolia, Pakistan, and Russia, including government entities.\n- Driver signed with an expired certificate; added to Defender exclusions before deployment.\n\n## Further reading & sources\n\n- [CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit | Securelist](https:\u002F\u002Fsecurelist.com\u002Fhoneymyte-coolclient-driver-rootkit\u002F121028) — Kaspersky Securelist\n- [HoneyMyte CoolClient Rootkit: Critical Threat Exposed](https:\u002F\u002Fblog.cybernexora.com\u002Fhoneymyte-coolclient-rootkit)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5",{"iocs":19,"actors":23,"malware":30,"technologies":35},[20],{"type":21,"value":22},"other","msagent.sys",[24],{"url":25,"name":11,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fmustang-panda","mustang-panda","apt","China (PRC state-sponsored; court documents say the PRC government paid the group)","espionage",[31,32,34],{"name":22},{"name":33},"PlugX",{"name":12},[36],{"vendor":37,"product":38},"Microsoft","Windows","threat_actor_activity","2026-08-29T12:13:55.8896+00:00","2026-10-16T12:29:04.072979+00:00",null,{"articles":44},[45,57,69,82],{"slug":46,"title":47,"summary":48,"tags":49,"hero_image_url":55,"story_type":39,"created_at":56},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.",[50,51,52,15,53,54],"Armored Likho","BusySnake Stealer","Kaspersky","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":58,"title":59,"summary":60,"tags":61,"hero_image_url":66,"story_type":67,"created_at":68},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanizes TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Head Mare APT is exploiting an unpatched TrueConf video conferencing server to trojanize the client installer and deliver PhantomCore and PhantomGraph backdoors to Russian organizations across six sectors.",[62,63,64,65,15],"Head Mare","TrueConf","PhantomCore","PhantomGraph","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","campaign","2026-08-28T17:23:49.323621+00:00",{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":80,"story_type":39,"created_at":81},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[74,75,76,77,78,79],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":93,"story_type":39,"created_at":94},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[87,88,89,90,91,92],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00"]