HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit to Hide Itself

Key Takeaways

• The HoneyMyte APT group has enhanced its CoolClient backdoor with a new kernel-level rootkit.
• This rootkit significantly improves the malware’s stealth capabilities on Windows systems, making detection and investigation more challenging for security professionals.
• The attack chain involves initial compromise with PlugX, followed by the installation of CoolClient, often through DLL sideloading using legitimate applications.
• Targets include government entities and organizations in Pakistan, Mongolia, Myanmar, and Russia.
• No direct fix is available, but robust mitigation strategies focusing on kernel-level telemetry and vigilance against suspicious system alterations are crucial.

The advanced persistent threat (APT) group HoneyMyte has significantly upgraded its CoolClient backdoor, integrating a sophisticated kernel-level rootkit designed for Windows operating systems. This enhancement drastically complicates forensic investigations and defensive measures, allowing the malware to evade standard security checks and maintain persistence on compromised systems.

This updated CoolClient variant has been observed targeting government entities and other organizations across Pakistan, Mongolia, Myanmar, and Russia. The tactical shift indicates a clear intent by HoneyMyte to bolster its operational secrecy and longevity within victim networks.

In one notable instance in Myanmar, attackers initially deployed the PlugX malware to establish a beachhead before subsequently installing CoolClient as a secondary, more resilient backdoor. This multi-stage approach, where a trusted program is leveraged to execute malicious code, mirrors previously documented PlugX USB worm campaigns. It also underscores the group’s strategy of deploying layered tools rather than relying on a single implant for its malicious objectives.

Researchers at Securelist uncovered this new CoolClient variant during their investigations spanning late 2025 and 2026. According to a Securelist report, the kernel driver facilitates the concealment of processes, files, registry entries, and specific command-and-control (C2) communications. This deep-level stealth is particularly concerning because kernel components operate at a foundational level, beneath most user-mode monitoring utilities, rendering them invisible to many traditional security tools.

The CoolClient backdoor itself possesses a wide array of capabilities, including keystroke logging, clipboard data exfiltration, credential harvesting, extensive system reconnaissance, and file manipulation. By shifting critical operational components into the Windows kernel, the malware can effectively manipulate what security tools perceive, thereby gathering intelligence and facilitating lateral movement within the compromised environment without detection.

HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit

The infection sequence typically begins after PlugX has already established an initial foothold on the target system. Attackers then create a deceptive “Windows Defender” folder, configure exclusions for this folder and a renamed executable, and proceed to use a legitimate Sangfor application, renamed to “defender.exe,” to sideload a malicious DLL file named “libngs.dll.”

This DLL sideloading technique, which abuses a legitimate program to mask malicious activity, has been documented in other campaigns, such as those attributed to the Mustang Panda group, highlighting a recurring pattern of misusing trusted applications. The malware also establishes persistence through a scheduled task, enabling the renamed program to launch with SYSTEM privileges upon startup. Additionally, CoolClient creates an AutoRun entry and, in some cases, installs a service named “media_updaten.”

Further enhancing its stealth, the malware injects its code into a process named “synchost.exe.” This deliberate misspelling closely resembles the legitimate Windows “svchost.exe” process, making it difficult for an analyst to spot during a cursory review.

Once elevated to administrator rights, the malware decrypts and writes its kernel driver, “msagent.sys,” installing it as a Windows driver service. Although this driver bears a digital signature, it is crucial to note that this signature does not guarantee its legitimacy. The certificate in question was issued to “Nanjing Ranyi Technology Co., Ltd.” and had expired years prior to the observed campaign, rendering it invalid for proving authenticity or safety.

The driver communicates with the CoolClient backdoor through a direct Windows communication channel. It registers CoolClient as a trusted entity, records its installation path and service registry location, and accepts the configured C2 server address. This mechanism effectively protects the malware’s files while simultaneously denying access to other processes. Similar abuse of trusted filenames has been observed in other new Windows backdoors, underscoring why file names alone are insufficient indicators of trustworthiness.

Hidden Files and C2 Traffic

The “msagent.sys” rootkit leverages several Windows callbacks to monitor processes, loaded modules, file system activity, and registry operations. It can restrict the permissions granted to other programs attempting to interact with the protected CoolClient process. This capability can thwart attempts to terminate, inspect, or inject code into the backdoor, ensuring its continued operation even if an analyst identifies the suspicious process.

Its file-system filter actively conceals specified folders and files by denying access during routine operations. Concurrently, a separate registry callback mechanism removes protected keys and values from enumeration results, while also blocking any attempts to open, modify, or delete them. The driver can also unlink its process from Windows’ active-process listings, ensuring it does not appear in basic task manager views.

A particularly sophisticated feature involves the rootkit hooking the Windows Nsiproxy driver. This allows it to remove registered C2 IP addresses from network data presented to user-mode tools. Consequently, a defender performing network connection inspections might completely miss the backdoor’s actual communication channels. HoneyMyte previously employed a similar technique in an earlier HoneyMyte rootkit report, indicating a consistent and evolving strategy for long-term concealment.

What You Should Do

• Monitor for Suspicious Driver Services: Actively look for unexpected or newly installed driver services on Windows systems.
• Scrutinize File and Directory Anomalies: Investigate fake security product directories (e.g., “C:Program Filesmicrosoftwindows defender”), unusual Defender exclusions, and mismatched DLLs found alongside legitimate applications.
• Review Scheduled Tasks and AutoRun Entries: Pay close attention to scheduled tasks and AutoRun entries that launch executables like “defender.exe” or “Sang.exe” from unusual or non-standard locations.
• Verify Driver Signatures and Certificate Status: Always verify the digital signatures of drivers and check the validity and expiration status of their associated certificates. Expired or revoked certificates are a significant red flag.
• Implement Kernel-Level Telemetry: Shift monitoring strategies to collect and analyze kernel-level telemetry rather than relying solely on user-mode process and network views, which this rootkit is designed to evade.
• Analyze IoCs: Use the provided Indicators of Compromise (IoCs) in your threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for detection and hunting. Note that IP addresses and domains are intentionally defanged (e.g., [.]) and should only be re-fanged within controlled environments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.