Loading story…
HoneyMyte, also tracked as Mustang Panda, has deployed a new 2025–2026 variant of its CoolClient backdoor that adds a signed Windows kernel-mode driver, msagent.sys, to deepen stealth and persistence during espionage intrusions. Researchers said the malware retains its multi-stage DLL sideloading design but now uses rootkit functions to hide and protect malicious processes, files, and registry objects, while also filtering network information linked to command-and-control infrastructure through an Nsiproxy hook.
In one intrusion targeting Myanmar, the group reportedly used PlugX as an initial implant before installing CoolClient from a fake Windows Defender directory via a renamed legitimate Sangfor executable. The malware persists through AutoRun entries, scheduled tasks, and Windows services, injects into synchost.exe, and can relaunch itself with elevated privileges using an RPC-based UAC bypass with PPID spoofing. Victims were identified in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, indicating HoneyMyte is expanding kernel-level defense evasion in post-compromise operations.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that HoneyMyte used the updated CoolClient in 2026 against government and private-sector organizations in India, expanding the known set of affected countries beyond Myanmar, Mongolia, Pakistan, and Russia. The activity involved the same upgraded malware family with the msagent.sys kernel driver.
A new CoolClient variant attributed to HoneyMyte/Mustang Panda was observed in late 2025 and 2026. The updated malware adds a signed kernel-mode driver, msagent.sys, to provide rootkit capabilities such as hiding malware processes, files, registry objects, and filtering network information tied to command-and-control infrastructure.
The report identified victims of the upgraded CoolClient activity in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities. The updated variant and its driver were specifically observed in intrusions in Pakistan, Mongolia, and Myanmar.
When administrative privileges were available, CoolClient extracted an embedded compressed driver, wrote it to disk as msagent.sys, and created and started a driver service named msagent. The user-mode backdoor then opened \\.\msagent and initialized the driver with IOCTL requests to trust the malware process, register protected paths, and pass the configured C2 IPv4 address.
The updated variant checked for administrator privileges and used an RPC-based UAC bypass with PPID spoofing, involving winver.exe and computerdefaults.exe, to relaunch itself with elevated rights. It then injected decrypted payload stages into suspended synchost.exe processes instead of the older write.exe target.
During execution, CoolClient established persistence through an AutoRun entry named goopdate, a scheduled task masquerading as Microsoft Windows Defender Advanced Threat Protection Service, and installation as a Windows service such as media_updaten. These mechanisms launched the malware at logon or startup and, in some cases, as SYSTEM.
In an observed campaign targeting Myanmar, HoneyMyte used PlugX as the initial post-compromise implant before deploying CoolClient. The actor prepared a fake Windows Defender directory, added Defender exclusions, and used a renamed legitimate Sangfor executable for DLL sideloading.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
12 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecryptika.com
Open sourcesecurityaffairs.com
Open sourcesecurelist.com
Open sourcesecurelist.ru
Open sourcede.securelist.com
Open sourcede.securelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the China-aligned espionage group **Mustang Panda** (aka **HoneyMyte** / **Bronze President**) has updated its *CoolClient* backdoor, adding capabilities to steal browser login data and monitor the clipboard, alongside broader enhancements to its data theft and reconnaissance tooling. The activity has primarily targeted **government entities**, with observed campaigns affecting Myanmar, Mongolia, Malaysia, and Russia (with additional reporting noting targeting in Pakistan), and CoolClient often appearing as a **secondary backdoor** alongside **PlugX** and **LuminousMoth**. The updated intrusion chain commonly relies on **DLL sideloading** using legitimate signed executables to load malicious DLLs, with CoolClient delivered via encrypted loader components and multi-stage execution using encrypted `.DAT` files (e.g., `main.dat`). Reported functionality includes host and user profiling, file operations, keylogging, TCP tunneling, reverse-proxying, and in-memory execution of fetched plugins, with persistence achieved through **Registry modifications**, creation of **Windows services**, and **scheduled tasks**, plus support for **UAC bypass** and privilege escalation. Kaspersky also noted CoolClient being deployed via legitimate software associated with *Sangfor* and stated the malware has been used to deploy a **previously unseen rootkit**, with further technical details expected in follow-on reporting.
Jun 29, 2026
The HoneyMyte advanced persistent threat (APT) group, also known as Mustang Panda or Bronze President, has been observed deploying a new kernel-mode rootkit to deliver the ToneShell backdoor in targeted attacks against government organizations in Southeast and East Asia. The malicious driver, registered as a mini-filter and signed with a stolen or leaked digital certificate, is designed to inject the ToneShell backdoor into system processes while protecting malicious files, user-mode processes, and registry keys from detection or removal. The campaign, active since at least February 2025, primarily targets entities in Myanmar and Thailand, with evidence suggesting that affected victims had previously been compromised by other HoneyMyte tools such as the ToneDisk USB worm, PlugX, and earlier ToneShell variants. Technical analysis reveals that the rootkit, named `ProjectConfiguration.sys`, embeds user-mode shellcodes and leverages advanced evasion techniques, including runtime API resolution and interception of file-system operations to prevent deletion or renaming of its components. The ToneShell backdoor provides attackers with a reverse shell and persistent access to compromised systems, facilitating cyberespionage activities. Command-and-control infrastructure for this campaign was registered in late 2024, and the operation demonstrates a continued evolution in HoneyMyte's toolset and tactics, underscoring the persistent threat posed by this state-sponsored actor to high-profile organizations in the region.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026