HoneyMyte's CoolClient now ships a signed kernel driver that hides its own process

Securelist researchers report that the newest variant of CoolClient, a backdoor family attributed to the HoneyMyte APT group (also tracked as Mustang Panda), can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests ^[1]. According to the same analysis, the driver hides the CoolClient process, protects related files and registry entries, and prevents them from being inspected or modified ^[2].

That combination is the whole story for defenders. If the process list, the file system view and the registry view handed to a user-mode agent are being filtered by a driver, then the absence of a detection is not evidence of absence. Securelist frames the overall design as comparable to kernel-mode enhancements previously seen in ToneShell, with one difference worth noting: the CoolClient driver exposes dedicated IOCTL handlers so the user-mode backdoor can talk to it directly ^[3]. This is not an opportunistic bring-your-own-vulnerable-driver trick bolted on at the end. It is a two-part implant with a defined interface between the halves.

The user-mode half remains conventional and, in the observed intrusions, well prepared. Securelist says HoneyMyte used PlugX as the initial post-compromise implant to deploy the CoolClient components in a campaign targeting Myanmar ^[4]. Before deployment, the actor added both a folder exclusion and a file exclusion to Microsoft Defender, covering a fake Windows Defender installation directory and the renamed sideloader executable ^[5]. That sideloader is a legitimate Sangfor executable, usually named Sang.exe, copied into the fake directory as defender.exe ^[6]. Persistence came from a scheduled task launching defender.exe with SYSTEM privileges at system startup ^[7], after which it sideloads the malicious libngs.dll ^[8].

The loader chain is built to survive a casual look. libngs.dll exports numerous dummy functions that each call OutputDebugStringA with their own name and then immediately call ExitProcess, purely to mimic the export table of the legitimate DLL ^[9]. The real logic sits in DllMain, obfuscated with control flow flattening and large numbers of unconditional jumps, and its job is to read, decrypt and execute the second stage ^[10]. Decryption uses a 0x32-byte repeating XOR keystream derived from a transformed seed value of 0xA4, after which the DLL is loaded directly into memory ^[11]. The second and final stages, previously named loader.dat and main.dat, are now loadcert.ini and cert.ini ^[12], and the second stage prepares the environment before the malware moves into an injected synchost.exe ^[13].

This is an incremental family, not a new one. CoolClient was first publicly disclosed by Sophos in 2022 and analysed by Trend Micro in 2023 ^[14], with Securelist documenting a 2025 variant that added clipboard theft and HTTP traffic interception for credential harvesting ^[15]. Roughly four years separate that first disclosure from the late 2025 and 2026 investigation behind the driver findings ^[16]. Reported capabilities already include keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and plugin-based extensions ^[17], against targets across Asia and Russia ^[18]. Securelist says the updated variant and its driver have been seen in intrusions in Pakistan, Mongolia and Myanmar ^[19].

Three things to watch. Whether the signing certificate behind the driver gets revoked, since Securelist describes the driver only as signed ^[1]. Whether the Defender exclusion writes are being alerted on in your estate, because they preceded the payload in the Myanmar case ^[5]. And whether your process and file inventories come from anywhere other than the host that may be lying to you.