The threat actor known as HoneyMyte (alias Mustang Panda) has been detected using an updated version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit capable of hiding and protecting malicious processes, files, registry objects, and command-and-control (C2) network information. Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, with CoolClient being deployed as a secondary backdoor following a PlugX infection. While its execution flow closely mirrors previous documented CoolClients, this instance introduces an uncharted kernel-mode driver that substantially enhances the malware's stealth capabilities," Kaspersky stated.
The actor copied the malware components into this directory, renamed another legitimate software to defend.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup. The second-stage malware sets up an AutoRun registry entry called "goopdate" and installs a Windows service named "media_updaten." It leverages remote procedure call (RPC)-based process creation combined with parent process ID spoofing to relaunch itself in elevated context before injecting into the synchost.exe process.
The driver also implements process hiding by unlinking entries from the Windows active process list, denies access to protected files and directories through filesystem minifilters, registers a registry callback for removing protected keys and values, and blocks attempts to modify or delete them.
