Analysis
The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor. It is dropped only after the group first breaks in with PlugX, an older tool HoneyMyte favors for initial access. In the Myanmar case, HoneyMyte attackers told Microsoft Defender to ignore the folder they planned to use, so their files would not be scanned. They then made a fake Microsoft\Windows Defender folder, put the CoolClient files inside, and renamed a trusted Sangfor program (normally Sang.exe) to defender.exe. A scheduled task keeps the malware running by launching defender.exe with SYSTEM rights every time the computer starts.
When defender.exe runs, it loads a malicious file called libngs.dll, which starts a chain of hidden stages. libngs.dll unlocks and runs a second file, loadcert.ini, that does most of the work. It adds more ways to stay on the machine, an AutoRun entry named goopdate and a service called media_updaten, but only after checking that security tools like 360 Total Security are not running. To gain higher access without showing a prompt, HoneyMyte's CoolClient uses a trick that makes its actions look like they came from a trusted Windows process. It then hides its code inside synchost.exe and loads the final piece, cert.ini, which runs the backdoor's real work.
The big change in this version of CoolClient is the kernel driver. Once CoolClient has admin rights, it unpacks a driver, saves it as msagent.sys, and loads it as a service. The backdoor then talks to this driver to hide itself, protect its files and registry entries, and pass along its server address. The driver carries an old but still-valid certificate from 2014, which helps it load without warnings. From deep inside Windows, msagent.sys can hide processes, files, folders, registry keys, and even other drivers. It ships with 33 built-in commands, though this HoneyMyte sample used only three.
With the driver in place, cert.ini carries out the spying CoolClient is built for: logging keystrokes, stealing clipboard contents, grabbing saved passwords, browsing files, and collecting system details, with more features added through plugins. The stolen data is sent back to HoneyMyte's server, while the driver quietly removes that same server address from any network view on the machine. The result is a hard problem for defenders: the connection is real, but the usual signs on the computer may never appear.
Mitigation
Ingest the file hashes, malicious domains, and file paths from this advisory into endpoint, DNS, and web-proxy blocklists, and alert on any historical matches uncovered during retro-hunting.
Because CoolClient is only deployed after a PlugX infection, treat any PlugX detection as a trigger for a full compromise assessment rather than a simple clean-up, since a deeper secondary backdoor is likely already present.
Enable Microsoft's vulnerable driver blocklist and use Windows Defender Application Control (WDAC) or equivalent allow-listing to stop old, third-party-signed drivers such as msagent.sys, signed with a certificate that expired in 2014, from loading into the kernel.
Alert on programmatic changes to Microsoft Defender exclusions, especially folder or file exclusions added through wmic and MSFT_MpPreference, which HoneyMyte uses to blind Defender before staging the malware.
Watch for the AutoRun value goopdate under the Run key, creation of services named media_updaten or msagent, and scheduled tasks that impersonate Microsoft Defender ATP and run as SYSTEM at startup.
Restrict local administrator rights and monitor for the RPC-based, parent-process-spoofing elevation technique, since driver deployment proceeds only when the malware obtains administrative access and SeTcbPrivilege.
Use endpoint tooling with kernel-level visibility and periodically compare live process, driver, and network views against trusted out-of-band baselines to surface objects a rootkit may be hiding.
Given HoneyMyte's focus on government entities across Asia and Russia, apply network segmentation, tighten monitoring around sensitive systems, and run proactive threat hunts aligned to HoneyMyte tradecraft.
Threat Intelligence
| Type | Value |
|---|---|
| MD5 | 2d7c8780e97409770a9d4f31c66c9d63 9460E150E1981D5C165043520C5C12FE 9717F005C5FB98E08D2AD983D88F94EE F518D8E5FE70D9090F6280C68A95998F EB79558B037669792652A816E2C669DE |
| SHA256 | EE72AE4CC869AFFDDAB11647E95BAB9C5691C9FC76DCB4B31650FF504DA29156 FD434AC879122DEDB754BD4835822DBC185ACE3A3E75E5898FFB40C213A7C4BA BF75493840862F0C9416D60A13DC92E72A7336056B2A2E22EF1D4DA44255EBAA E0D77BCEB5EBB3FF6F31EB7B0A4671CFF8B599A0015B63FA94121B89A949F729 B35C17B889030ACED7B41158C1B6A6E8ED9C0D0290EBCEA28D1E3FE7DEEACCFC |
| File Path | C:\Program Files\microsoft\windows defender\ C:\Program Files\windows media player\mediares\ C:\ProgramData\symantecdir\ C:\ProgramData\virtualstore\ C:\Windows\identitycrl\production\ C:\Windows\serviceprofiles\networkservice\ C:\Users\<user>\AppData\Local\viber24.8\ C:\Users\<user>\AppData\Roaming\dsassistant\ C:\Program Files\common files\microsoft shared\office14\ C:\programdata\msdn\ |
| Domains | cloudtroe.giize.com employers.theworkpc.com freeread.casacam.net us.lenovoappstore.com sundanish.freeddns.org torinarlabs.webredirect.org news.dursamjbataar.org video.dursamjbataar.org black-popular.com whatismybestthing.com |
Adversary Behavior
T1569.002 Service ExecutionT1547.001 Registry Run Keys / Startup FolderT1053.005 Scheduled TaskT1543.003 Windows ServiceT1548.002 Bypass User Account ControlT1134.004 Parent PID SpoofingT1574.002 DLL Side-LoadingT1562.001 Disable or Modify ToolsT1036.005 Match Legitimate Name or LocationT1553.002 Code SigningT1070.004 File DeletionT1056.001 KeyloggingSources
At Hive Pro, it is our mission to detect the most likely threats to your organization and help you prevent them before they happen.
Platform
Arbis AI
The HivePro Platform
Integrations
HiveForce Labs
Compare
vs Rapid7
vs Tenable
vs Qualys
vs Nucleus
Solutions
Attack Surface Mgmt
Multi-Env Scanners
Exposure Assessment
Security Intelligence
Threat Prioritization
Exposure Validation
By Role
CISO
Vulnerability Managers
