Mustang Panda, also known as HoneyMyte, has integrated a signed Windows kernel-mode rootkit with its CoolClient backdoor, enhancing its ability to obscure malicious processes and data. This development was reported by Kaspersky, a Russian cybersecurity firm, which identified the presence of CoolClient in various countries, including Myanmar, Mongolia, Pakistan, and Russia. The backdoor is typically deployed post-PlugX infection, suggesting an advanced multi-stage attack strategy.
Stealth Techniques in Malware Deployment
The updated CoolClient utilizes a kernel component that activates upon gaining full access to the Windows Service Control Manager, coupled with the SeTcbPrivilege privilege. This allows it to bypass driver deployment restrictions. If these conditions are unmet, the malware skips to the final stage of its implant sequence. Kaspersky has made public several indicators of compromise, such as file hashes and C2 domains, to aid in detection efforts.
Kaspersky’s analysis highlights that while the execution flow of CoolClient remains as previously documented, the introduction of a new kernel-mode driver significantly boosts its stealth capabilities. This driver can be installed as a Windows service and is managed via IOCTL requests from the user-mode backdoor, facilitating operations like keylogging and system reconnaissance.
PlugX: The Initial Vector
In a targeted operation in Myanmar, PlugX was used to initiate the compromise, setting the stage for CoolClient deployment. The threat actor employed techniques like Microsoft Defender exclusions and DLL sideloading to obscure activities and maintain persistence. By renaming legitimate executables and scheduling tasks, the malware ensures its continuity across system reboots.
Execution commences with the loading of a malicious DLL, which decrypts and executes subsequent components. These components are responsible for a variety of malicious activities, including registry modifications and User Account Control bypasses. The malware’s ability to inject itself into processes like synchost.exe underscores its sophistication in evading detection.
Rootkit Capabilities and Impact
The rootkit, identified as msagent.sys, is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd., although no direct links have been found between older malicious drivers and current activities. Once operational, the rootkit handles configuration via CoolClient through IOCTL requests, managing tasks like process protection and filesystem access.
This rootkit employs numerous techniques to maintain stealth, such as process hiding and registry manipulation. It filters network information to shield C2 communications from user-mode scrutiny. Despite the presence of extensive IOCTL handlers, only a select few were utilized in the observed samples, indicating targeted functionality deployment.
The continuous evolution of CoolClient and its integration with sophisticated rootkits poses significant challenges for cybersecurity defenders. As Mustang Panda refines its tools, understanding and mitigating such threats becomes increasingly critical for organizations worldwide.
