Loading story…
Kaspersky reported that the China-aligned espionage group Mustang Panda (aka HoneyMyte / Bronze President) has updated its CoolClient backdoor, adding capabilities to steal browser login data and monitor the clipboard, alongside broader enhancements to its data theft and reconnaissance tooling. The activity has primarily targeted government entities, with observed campaigns affecting Myanmar, Mongolia, Malaysia, and Russia (with additional reporting noting targeting in Pakistan), and CoolClient often appearing as a secondary backdoor alongside PlugX and LuminousMoth.
The updated intrusion chain commonly relies on DLL sideloading using legitimate signed executables to load malicious DLLs, with CoolClient delivered via encrypted loader components and multi-stage execution using encrypted .DAT files (e.g., main.dat). Reported functionality includes host and user profiling, file operations, keylogging, TCP tunneling, reverse-proxying, and in-memory execution of fetched plugins, with persistence achieved through Registry modifications, creation of Windows services, and scheduled tasks, plus support for UAC bypass and privilege escalation. Kaspersky also noted CoolClient being deployed via legitimate software associated with Sangfor and stated the malware has been used to deploy a previously unseen rootkit, with further technical details expected in follow-on reporting.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Kaspersky publicly reported that HoneyMyte/Mustang Panda had resurfaced with an evolved 2025 toolset centered on an upgraded CoolClient backdoor, browser credential stealers, and broader real-time surveillance and data theft capabilities.
In 2025 operations, Mustang Panda used batch and PowerShell scripts for system enumeration, internal scanning, document collection, compression, and exfiltration via FTP and public services such as Pixeldrain, with at least one case involving Firefox cookie theft to Google Drive.
Also in 2025, the actor broadened its espionage model by deploying multiple browser login-data stealers targeting Chrome, Edge, and other Chromium-based browsers, using DPAPI to decrypt saved credentials from infected systems.
In 2025, Mustang Panda enhanced CoolClient with capabilities including clipboard monitoring, active window title tracking, HTTP proxy credential sniffing, TCP/UDP command-and-control support, and in-memory plugins for file, service, and shell operations.
A 2024–2025 campaign targeting Pakistan and Myanmar delivered a CoolClient variant that also dropped a previously unseen rootkit, marking a stealth and persistence escalation.
In 2024–2025 activity, the group used DLL sideloading and trojanized legitimate software, especially Sangfor applications, to deploy newer CoolClient variants and establish persistence through services, scheduled tasks, and registry changes.
During 2024 and 2025, Mustang Panda intensified espionage activity targeting government, diplomatic, and critical infrastructure organizations across Asia and Eastern Europe, including victims in Myanmar, Mongolia, Malaysia, Russia, and Pakistan.
CoolClient has been associated with Mustang Panda since 2022, where it was used as a secondary backdoor alongside other implants such as PlugX and LuminousMoth.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcerescana.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HoneyMyte, also tracked as Mustang Panda, has deployed a new 2025–2026 variant of its **CoolClient** backdoor that adds a signed Windows kernel-mode driver, `msagent.sys`, to deepen stealth and persistence during espionage intrusions. Researchers said the malware retains its multi-stage DLL sideloading design but now uses rootkit functions to hide and protect malicious processes, files, and registry objects, while also filtering network information linked to command-and-control infrastructure through an `Nsiproxy` hook. In one intrusion targeting Myanmar, the group reportedly used **PlugX** as an initial implant before installing CoolClient from a fake Windows Defender directory via a renamed legitimate Sangfor executable. The malware persists through AutoRun entries, scheduled tasks, and Windows services, injects into `synchost.exe`, and can relaunch itself with elevated privileges using an RPC-based UAC bypass with PPID spoofing. Victims were identified in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, indicating HoneyMyte is expanding kernel-level defense evasion in post-compromise operations.
Aug 18, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026