Mustang Panda Arms CoolClient with Signed Rootkit: EDR in the…

HoneyMyte deploys msagent.sys, a kernel-mode rootkit driver signed with an expired 2013 certificate. It hides processes, files, and C2 traffic by subverting user-mode visibility checks.

The HoneyMyte group, known as Mustang Panda, began distributing an updated variant of the CoolClient backdoor augmented with a kernel-mode rootkit driver on August 14, 2026. The component, named msagent.sys and signed with an expired certificate from Nanjing Ranyi Technology Co., Ltd., raises the stakes for defenders: no longer mere evasion of security products, but direct sovereignty over Windows visibility primitives.

Key Takeaways

HoneyMyte (Mustang Panda) deployed an updated CoolClient variant with a signed rootkit driver, msagent.sys, according to Kaspersky GReAT analysis.
The driver implements 33 IOCTL handlers, three observed in operation: trusted process registration (0x222120), C2 address passing (0x2221E0), and file/registry path protection (0x2220F0).
The signature uses a Nanjing Ranyi Technology Co., Ltd. certificate valid from August 2013 to September 2014, giving the driver formal legitimacy in the eyes of Windows Driver Signature Enforcement.
Confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, with government entities identified in Kaspersky telemetry.

How the msagent.sys Rootkit Works

The driver installs as a Windows service named msagent and establishes a dedicated IOCTL channel with the user-mode backdoor. Three codes dominate observed traffic: 0x222120 to register a process as "trusted," 0x2221E0 to communicate the IPv4 address of the command-and-control server, and 0x2220F0 to shield files and registry keys from reading and modification.

The process-hiding technique goes beyond user-mode API hooking. The driver directly manipulates ActiveProcessLinks in the kernel's EPROCESS structure, unlinking the target process from the circular list that tools like Task Manager and many EDRs traverse. To maintain cross-version Windows compatibility, the field offset is resolved dynamically rather than hardcoded.

File protection occurs via a filesystem minifilter that denies access to specified paths regardless of the requester's privileges. For the registry, the driver registers a callback via CmRegisterCallbackEx that removes protected keys from enumerations and blocks modification or deletion operations. The C2 channel is hidden by intercepting queries to the Nsiproxy driver: the configured IPv4 address is filtered before network information reaches user-mode.

The driver exposes 33 IOCTL handlers in total, but only three were active in analyzed samples. The remaining implement latent capabilities: shellcode injection, kernel module hiding, process termination, Protected Process Light (PPL) protection removal, and direct kernel memory writes.

The Infection Chain and the Expired Certificate

In intrusions documented by Kaspersky, CoolClient is not the initial entry point. The group uses PlugX as the initial post-compromise implant, then deploys CoolClient as a secondary backdoor with rootkit capabilities. Persistence is achieved via a scheduled task disguised as "Windows Defender Advanced Threat Protection Service," running with SYSTEM privileges, and an AutoRun entry named goopdate.

DLL side-loading exploits a legitimate Sangfor executable renamed defender.exe, which loads the malicious library libngs.dll. Before deployment, exclusions are added to Microsoft Defender for a spoofed Windows Defender directory. A recent variant shifted injection from write.exe to synchost.exe; the UAC bypass uses an RPC-based technique with parent process ID spoofing.

The signing certificate, issued to Nanjing Ranyi Technology Co., Ltd. with validity August 2013 – September 2014, is expired but formally valid for Windows checks that accept non-revoked certificates within their own criteria. According to Kaspersky, it cannot be determined whether the certificate was stolen, leaked, or obtained fraudulently. The driver's embedded PDB path contains Chinese strings: 南京实验室 (Nanjing Laboratory) and 张雪杰云南m (Zhang Xuejie Yunnan m), which may reflect the development environment or represent a false flag operation.

"Our analysis confirms that the investigated malware is a new CoolClient variant associated with the HoneyMyte threat group. While the overall execution flow remains consistent with previously documented CoolClient variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware's stealth capabilities." — Kaspersky GReAT, via The Hacker News

Comparison with ToneShell and Toolkit Evolution

The CoolClient driver architecture parallels the kernel-mode rootkit documented by Kaspersky for ToneShell in December 2025. In that case the driver was named ProjectConfiguration.sys and used a different certificate (Guangzhou Kingteller). The evolutionary path is consistent: both HoneyMyte projects abuse signed drivers to elevate control over the operating system, but the CoolClient driver exposes a dedicated IOCTL interface allowing the user-mode backdoor to communicate directly with the kernel without intermediaries.

As of January 2026, a CoolClient variant with a "previously unobserved rootkit" had already emerged, per Kaspersky documentation. The temporal and functional relationship between that component and the August 2026 msagent.sys has not been clarified: they could be distinct drivers or successive iterations of the same project.

The commoditization of these techniques within the Mustang Panda toolkit suggests that signed rootkit adoption will not remain confined to individual campaigns. The investment in cross-version drivers with dynamic kernel structure resolution indicates long-term intent rather than an isolated experiment.

Immediate Actions

Check EDR telemetry for services named msagent with a driver signed by Nanjing Ranyi Technology Co., Ltd. or matching hashes published by Kaspersky: 2d7c8780e97409770a9d4f31c66c9d63 and 9460E150E1981D5C165043520C5C12FE.
Investigate scheduled tasks with names mimicking Microsoft services, particularly "Windows Defender Advanced Threat Protection Service" running with SYSTEM privileges.
Check for anomalous Microsoft Defender exclusions for spoofed Windows Defender directories preceding potential CoolClient component detection.
Adopt kernel-level forensics and memory analysis to detect processes hidden via ActiveProcessLinks manipulation, given the likely ineffectiveness of user-mode checks against this specific mechanism.

Why This Shifts the Detection Boundary

The arrival of msagent.sys signals a significant tactical shift. Until recently, Mustang Panda focused on user-mode evasion techniques: side-loading, process injection, UAC bypass. With CoolClient equipped with a kernel rootkit, the group attacks the very foundations of the visibility Windows provides to defenders. EDR, traditional forensic tools, and WMI/PowerShell queries become potentially blind against an actor that controls what the kernel reports to user-mode.

The choice of an expired but non-revoked certificate is functional: it evades signature checks without requiring a zero-day vulnerability in the Windows loader. Victims in Russia, alongside the usual Southeast Asian targets, indicate the campaign follows not a strict regional logic but rather selected strategic objectives.

Gray areas remain. It is unknown whether the 30 unobserved IOCTL handlers have been activated in other intrusions or represent a reserve for future samples. No infrastructure overlap currently links the Nanjing Ranyi certificate directly to other documented groups or campaigns. The nature of data exposed in the intrusions has not been detailed in public reports.

The brief does not document specific remediation measures released by security vendors. Kaspersky telemetry indicates ten active C2 domains in the campaign, including cloudtroe.giize[.]com and employers.theworkpc[.]com.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references