HoneyMyte's CoolClient adds a signed kernel driver that hides the backdoor from EDR

Securelist reports that the newest variant of CoolClient, the backdoor family it attributes to the HoneyMyte APT group, also tracked as Mustang Panda, can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests ^[1][6]. According to the same analysis the driver hides the CoolClient process and protects its files and registry entries from inspection or modification ^[7], which puts a routine espionage toolkit underneath the layer where most endpoint agents do their looking.

This is not a novel implant getting a novel trick. CoolClient already did keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and plugin-based extensions ^[2], against organisations across Asia and Russia ^[3]. It was first publicly disclosed by Sophos in 2022 and analysed by Trend Micro in 2023 ^[4], and Securelist says a 2025 variant added clipboard theft and HTTP traffic interception for credential harvesting ^[5]. The kernel component surfaced in investigations covering late 2025 and 2026 ^[6], roughly three to four years after the family became public ^[23]. Securelist also notes the overall design is comparable to kernel-mode enhancements previously seen in ToneShell, though the CoolClient driver exposes dedicated IOCTL handlers for the user-mode backdoor to talk to it directly ^[8]. That reads as shared engineering inside the cluster rather than a one-off experiment.

The delivery around it is unremarkable, which is the point. In the Myanmar intrusion Securelist describes, PlugX was the initial post-compromise implant used to deploy the CoolClient components ^[9]. Before dropping anything, the operator added a folder exclusion and a file exclusion to Microsoft Defender covering a fake Windows Defender installation directory and the renamed sideloader binary ^[10], created that fake directory and copied the components into it ^[11], then renamed a legitimate Sangfor executable, usually Sang.exe, to defender.exe to act as the DLL sideloader ^[12]. Persistence was a scheduled task launching defender.exe with SYSTEM privileges at startup ^[13], and defender.exe sideloads the malicious libngs.dll to start the chain ^[14].

The loader is built to waste an analyst's time and to defeat name-based rules. libngs.dll exports numerous dummy functions that each call OutputDebugStringA and then ExitProcess ^[15], with the real logic in DllMain behind control flow flattening and unconditional jumps ^[16]. It decrypts the second stage with a 0x32-byte repeating XOR keystream derived from a transformed seed value of 0xA4 ^[17] and loads the DLL directly in memory ^[18]. The second- and final-stage files, previously loader.dat and main.dat, are now loadcert.ini and cert.ini ^[19], and the second stage prepares the environment before moving into an injected synchost.exe ^[20]. Any detection keyed to the old filenames is already stale.

What to watch: the published Securelist text reviewed here does not name the certificate that signed the driver, publish its hash, or say whether this is a legitimate signed driver being abused or attacker-obtained signing ^[21]. That distinction decides whether a vulnerable-driver blocklist is a control or paperwork. Until it is answered, the durable telemetry is not the driver itself but its scaffolding: new kernel service creation, driver image loads on servers that have no business loading one, Defender exclusion writes, and SYSTEM scheduled tasks pointing at directories that imitate Microsoft's own ^[6][10][13].