HoneyMyte Adds Kernel Rootkit to CoolClient Backdoor

The threat actor HoneyMyte (also known as Mustang Panda) is deploying an evolved version of the CoolClient backdoor that incorporates a signed Windows kernel-mode rootkit. This campaign has primarily targeted government entities and strategic organizations in Myanmar, Mongolia, Pakistan, and Russia. The rootkit provides significant stealth capabilities by hiding processes, files, and registry keys from security tools, while also filtering network connections to conceal command-and-control (C2) infrastructure.

The attack chain typically begins with a PlugX infection, which is then used to deploy CoolClient components via DLL sideloading of legitimate applications like Sangfor. The second-stage loader, loadcert.ini, performs UAC bypass using RPC-based techniques and PPID spoofing before deploying the rootkit driver. The driver is notably signed with a revoked certificate from Nanjing Ranyi Technology Co., Ltd.

This development represents a high-risk escalation in adversary tradecraft. By moving to the kernel level, HoneyMyte can effectively bypass user-mode security solutions and maintain long-term, covert persistence on infected systems. Organizations in the targeted regions or sectors should immediately hunt for the specific driver and registry artifacts associated with this campaign.