The notorious threat actor group HoneyMyte has significantly enhanced its CoolClient backdoor by integrating a Windows kernel-level rootkit. This development complicates the task for cybersecurity professionals aiming to detect and analyze malicious activities. The upgraded toolset allows attackers to bypass standard security measures, targeting institutions across Pakistan, Mongolia, Myanmar, and Russia, including governmental bodies.
Advanced Tactics in Cyber Espionage
In Myanmar, the attackers employed a sophisticated strategy, initially deploying PlugX malware before installing CoolClient as a secondary backdoor. This tactic mirrors previous campaigns where trusted programs were exploited to execute harmful code, indicating a layered approach in HoneyMyte’s operations.
According to investigations by Securelist conducted in late 2025 and 2026, the new CoolClient variant employs a driver capable of concealing processes, files, and command-and-control connections. This level of concealment is critical as kernel components operate beneath typical monitoring utilities, providing attackers with an edge in gathering intelligence from targeted systems.
Operational Mechanisms of CoolClient
The infection process begins once PlugX gains a foothold in the system. Attackers then create a counterfeit Windows Defender directory, incorporating exclusions and using a renamed legitimate application, Sangfor, to execute a malicious DLL. This method is akin to tactics seen in the Mustang Panda campaign, where legitimate applications were repeatedly misused.
CoolClient establishes persistence by creating scheduled tasks and AutoRun entries, enabling the malware to initiate with SYSTEM privileges at startup. The malware then injects its code into a process deceptively named synchost.exe, allowing it to evade superficial security reviews.
Implications for Cyber Defense
With administrative privileges, CoolClient installs its driver, msagent.sys, as a Windows driver service. Despite carrying a digital signature, this should not be regarded as an assurance of safety, as the certificate had long expired. The driver manipulates Windows communication channels to shield malware while denying access to unauthorized processes.
The rootkit employs Windows callback functions to obscure processes, files, and registry activities. By reducing permissions for other programs attempting to interact with protected CoolClient processes, it prevents termination and inspection attempts. Furthermore, it removes command-and-control IP addresses from network data, complicating the detection of malicious traffic.
Security teams are advised to scrutinize unexpected driver services, fake security directories, and mismatched DLLs found alongside legitimate applications. Collecting kernel-level telemetry and verifying driver signatures are crucial steps in countering such threats. The CoolClient backdoor is designed to compromise systems while making detection challenging for responders.
Organizations must remain vigilant against these persistent threats and ensure their security protocols are robust enough to counteract such sophisticated cyberattacks.
