Mustang Panda deploys signed rootkit alongside CoolClient

Kaspersky has identified a new CoolClient backdoor variant linked to HoneyMyte, also known as Mustang Panda, that deploys a signed Windows kernel-mode rootkit. The activity affected victims in Myanmar, Mongolia, Pakistan and Russia, including confirmed government entities. In the cases investigated, CoolClient was consistently deployed as a secondary backdoor after a PlugX infection.

The added driver, written to disk as msagent.sys, is designed to hide and protect malicious processes, files, registry objects and command-and-control network information. Kaspersky said the component materially expands the stealth capabilities of CoolClient while retaining the execution flow seen in earlier variants.

Driver deployment depends on elevated privileges

CoolClient deploys the kernel component only when it has full access to the Windows Service Control Manager and the SeTcbPrivilege privilege. If either condition is unavailable, the malware skips driver installation and continues to its final-stage implant. When the conditions are met, its second-stage component extracts an embedded LZMA-compressed driver, creates a driver service called msagent, and starts it.

The driver is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. that was valid from August 2013 to September 2014. Kaspersky identified older malicious drivers signed with the same certificate and compiled around 2013, but said it found no direct evidence tying those samples to the CoolClient activity.

In one campaign against Myanmar, PlugX installed CoolClient after adding Microsoft Defender exclusions for a fake Windows Defender directory and a renamed sideloading executable. The actor renamed a legitimate Sangfor executable to defender.exe, which loaded a malicious libngs.dll. That DLL decrypted and executed the second-stage loadcert.ini component.

Rootkit hides assets and restricts inspection

Loadcert.ini manages persistence, registry changes, User Account Control bypass, process injection, driver deployment and loading of the final cert.ini implant. It can create an AutoRun entry named goopdate, install a service named media_updaten, and use RPC-based process creation with parent process ID spoofing before injecting into a process named synchost.exe.

CoolClient controls msagent.sys through input/output control requests. In the analysed sample, request 0x222120 marked the CoolClient process as trusted, 0x2221E0 supplied a configured C2 IPv4 address, and 0x2220F0 registered filesystem and registry paths for protection. The driver draws its stealth configuration from \REGISTRY\MACHINE\SYSTEM\RNG.

The rootkit registers filesystem, registry, process, object and image-load callbacks. It can reduce access rights when another process opens a handle to a protected process, obstructing actions such as termination and code injection. It also unlinks processes from the Windows active process list, blocks access to protected files and directories through a minifilter, and removes protected registry data from enumeration results. A hook in the Windows Nsiproxy driver filters configured C2 IPv4 addresses from network information returned to user mode.

Kaspersky found 33 IOCTL handlers in msagent.sys, although only three were invoked in normal execution of the analysed sample. The technique follows a wider pattern of evasive intrusion tooling, including ClickFix chains and AI agent incidents and its coverage of ClickFix chains, but this case adds a direct user-mode-to-kernel control channel for CoolClient. Organisations should use Kaspersky’s published hashes, paths and C2 domains to hunt for exposure, investigate unusual driver services and Defender exclusions, and review scheduled tasks that launch binaries with SYSTEM privileges.