# HoneyMyte Takes CoolClient Into the Kernel: When a Rootkit Changes What Windows Lets You See

## Summary

CoolClient was already a fully capable espionage backdoor: keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and a plugin-based extension architecture. The new variant Kaspersky published on 14 August 2026 **adds no meaningful espionage capability**.

It adds something else: a **signed kernel-mode driver**, installed as a Windows service and communicating with the user-mode component through IOCTL requests. That driver hides the CoolClient process, protects related files and registry entries from inspection or modification, and **filters the C2 address out of network information returned to user mode**.

The point to grasp: this driver does nothing "malicious" in the classical sense. It encrypts no data, steals no files, spreads nowhere. It **changes what Windows lets you see**. For defenders that is a shift from "where is the malware" to a considerably more uncomfortable question: **is my tooling telling me the truth.**

Victims were identified in Myanmar, Mongolia, Pakistan and Russia, including confirmed government entities.

**Priority action: sweep every endpoint for** `wmic` **commands adding Microsoft Defender exclusion paths — this step occurs earliest in the chain, before any malicious file is dropped and before any rootkit is in place to conceal it.**

* * *

## Background: CoolClient and HoneyMyte

CoolClient is a backdoor family attributed to the **HoneyMyte** APT group — also known as **Mustang Panda** — used in cyber-espionage campaigns targeting organisations across Asia and Russia.

The family's public disclosure history is well documented:

| Date | Source | Content |
| --- | --- | --- |
| 2022 | Sophos | First public disclosure, within research on related DLL sideloading cases |
| 2023 | Trend Micro | Further analysis in reporting on Earth Preta and updated stealthy strategies |
| 2025 | Kaspersky | A newer variant adding clipboard theft and HTTP traffic interception for credential harvesting |
| Late 2025 – 2026 | Kaspersky | **The kernel-mode driver variant** — the subject of this article |

**This is not HoneyMyte's first move into the kernel.** Kaspersky previously documented kernel-mode enhancements in ToneShell, and assesses the CoolClient driver's overall design as comparable. The important difference: **the CoolClient driver exposes dedicated IOCTL handlers**, letting the user-mode backdoor communicate directly with the driver rather than relying on static configuration alone.

Another consistent operational trait: across all observed intrusions, **CoolClient is deployed as a secondary backdoor after PlugX has established the initial foothold**. Kaspersky notes this deployment chain — PlugX as the initial post-compromise implant, then CoolClient — as one of the factors reinforcing attribution.

* * *

## Kill Chain

![Overview of the new CoolClient variant](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/14081516/coollient_honeymyte-driver-overview_555.jpg align="center")

*Overview of the new CoolClient variant with its kernel-mode component (source: Kaspersky GReAT).*

In the Myanmar campaign Kaspersky describes:

1.  HoneyMyte uses **PlugX** as the initial post-compromise implant to deploy the CoolClient components.
    
2.  Before deploying the malware, the actor **adds exclusions to Microsoft Defender** — both a folder exclusion and a file exclusion — for the fake Windows Defender installation directory and the renamed sideloader executable.
    
3.  A fake Windows Defender installation directory is created and the contents of the real Windows Defender folder copied into it via `xcopy`.
    
4.  The CoolClient components are copied in, and **a legitimate Sangfor executable** — usually named `Sang.exe` — is **renamed to** `defender.exe` to serve as the DLL sideloader.
    
5.  Persistence is established through a **scheduled task launching** `defender.exe` **with SYSTEM privileges at system startup**, named to impersonate a Windows Defender ATP service.
    
6.  On execution, `defender.exe` sideloads the malicious `libngs.dll` — the first-stage loader.
    
7.  `libngs.dll` decrypts `loadcert.ini` using a 0x32-byte repeating XOR keystream derived from a transformed seed of `0xA4`, and loads it directly into memory.
    
8.  `loadcert.ini` creates an AutoRun entry named `goopdate` under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
    
9.  If sufficient privileges are present and **no 360 Total Security processes are running**, it additionally installs a service named `media_updaten`.
    
10.  If administrative privileges are unavailable, it performs a **UAC bypass via RPC combined with parent process spoofing**.
     
11.  The decrypted `loadcert.ini` is injected into a newly created suspended `synchost.exe`, and the original process terminated.
     
12.  Inside `synchost.exe`, it decrypts `time.ini` and verifies full access to the Service Control Manager and the presence of `SeTcbPrivilege`.
     
13.  It extracts the embedded LZMA-compressed driver from `loadcert.ini`, writes it to disk as `msagent.sys` alongside `cert.ini`, and creates and starts the driver service.
     
14.  It opens the device `\\.\msagent` and issues **three** `DeviceIoControl` **requests** to initialise the driver.
     
15.  It enumerates active WinStation sessions, duplicates the access token, creates a new `synchost.exe` via `CreateProcessAsUserA`, and injects `cert.ini` — the final-stage implant handling C2 communication.
     

### Three Details Worth Separating Out

**The Defender exclusions come first.** The command runs before any malicious file touches disk:

```plaintext
wmic /Node:localhost /Namespace:\\Root\Microsoft\Windows\Defender Path MSFT_MpPreference
     call Add ExclusionPath="$programfiles\Microsoft\Windows Defender"
```

This is the **cheapest and earliest** detection point in the entire chain. More importantly, it happens while no rootkit is yet in place — so if you collect this event, you see it truthfully. After step 13, everything you observe has passed through the attacker's filter.

**The 360 Total Security check.** Before installing the service, the malware verifies that `360sd.exe`, `zhudongfangyu.exe` and `360desktopservice64.exe` are not running. If any is present, it abandons the service path and takes a different route. This detail tells you the authors have specific knowledge of what security software their targets tend to run.

**UAC bypass via RPC and parent process spoofing.** This is the most refined piece of the user-mode chain. The malware connects to a local `ncalrpc` endpoint (`201ef99a-7fa0-444c-9399-19ba84f12a1a`) and invokes `NdrAsyncClientCall` to launch `winver.exe`. It retrieves that process's debug object via `NtQueryInformationProcess`, detaches the debugger with `NtRemoveProcessDebug`, and terminates the process — **retaining the debug object for reuse**.

It then repeats the RPC technique to launch `computerdefaults.exe`, associates the retained debug object with the current thread via `DbgUiSetThreadDebugObject`, waits for the process creation event with `WaitForDebugEvent`, and duplicates the process handle via `NtDuplicateObject` to obtain full access rights.

Finally it relaunches itself with the `passuac` parameter, configuring `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS` through `UpdateProcThreadAttribute` so the duplicated handle becomes the new process's parent. The result: the new process runs in an elevated context and **appears to have been spawned by a trusted Windows process** rather than by CoolClient.

### Components in the Chain

| Component | Role |
| --- | --- |
| `defender.exe` / `Sang.exe` | Legitimate Sangfor application abused for DLL sideloading |
| `libsrapc.dll` | Benign dependency required for the Sangfor application to run normally |
| `libngs.dll` | First-stage loader, decrypts and loads the next stage into memory |
| `loadcert.ini` | Encrypted DLL implementing core functionality: command handling, process injection, driver deployment, persistence |
| `cert.ini` | Final-stage implant handling C2 communication and backdoor functionality |
| `time.ini` | CoolClient configuration file |

Worth noting on the disguise: `libngs.dll` exports numerous dummy functions. Each export simply calls `OutputDebugStringA` with its own name before immediately invoking `ExitProcess` — serving no purpose other than **mimicking the export table the legitimate DLL would have**. All the malicious logic sits in `DllMain`, heavily obfuscated through control flow flattening and numerous unconditional jumps.

![Dummy exports in libngs.dll](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13150435/honeymyte2.png align="center")

*Dummy export functions in* `libngs.dll` *invoking* `OutputDebugStringA` *and* `ExitProcess` *(source: Kaspersky GReAT).*

* * *

## The msagent.sys Driver

### Code Signing and PDB Path

![PDB path](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13150704/honeymyte5.png align="center")

*The PDB path embedded in the driver (source: Kaspersky GReAT).*

The driver is digitally signed with a certificate issued to `Nanjing Ranyi Technology Co., Ltd.`, serial number `3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD`. The certificate was **valid from August 2013 to September 2014**.

Kaspersky identified several older malicious drivers signed with the same certificate, compiled around 2013, but **found no evidence directly linking those samples to the CoolClient activity** described in the report.

The embedded PDB path contains several notable strings, including "南京实验室" (Nanjing Laboratory) and "张雪杰云南m" (Zhang Xuejie Yunnan m). Kaspersky states plainly that **its OSINT analysis did not identify any information linking these strings to a known organisation, developer or threat actor**. We preserve that caution rather than inferring further.

### Registry-Driven Configuration

![Registry configuration](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13150826/honeymyte6.png align="center")

*Configuration loaded by the driver from the registry during initialisation (source: Kaspersky GReAT).*

During initialisation the driver loads its stealth configuration from the registry key `\REGISTRY\MACHINE\SYSTEM\RNG`. Two `REG_DWORD` values control its operating mode:

```plaintext
Hid_State          default 1    Enables the driver's rootkit functionality
Hid_StealthMode    default 0    Controls additional stealth features
```

Six `REG_MULTI_SZ` values define the objects to hide or protect:

```plaintext
Wid_H1deF5Dirs        Directories to hide
Wid_H1deF5Files       Files to hide
Wid_H1deRegKeys       Registry keys to hide
Wid_H1deRegValues     Registry values to hide
Hid_IgnoredImages     Processes to ignore
Hid_ProtectedImages   Processes to protect
```

### Dynamic EPROCESS Offset Resolution

![Validating ActiveProcessLinks](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13150915/honeymyte7.png align="center")

*The driver validates candidate* `ActiveProcessLinks` *layouts before enabling process hiding (source: Kaspersky GReAT).*

The driver **locates the** `ActiveProcessLinks` **field within the** `EPROCESS` **structure dynamically rather than relying on hardcoded offsets**. It first validates several predefined offsets, and if none match, performs a linear scan of the structure to identify the correct location.

This lets the driver remain compatible across different Windows versions, where the `EPROCESS` layout may differ. It is a sign of code written for long-term use across many environments rather than for a single target.

Once the offset is identified, the driver uses IOCTLs `0x22219C` and `0x2221A0` to unlink and relink entries in the Windows active process list, hiding or restoring processes on demand.

### Four Protection Mechanisms

**Object callbacks.** Registered via `ObRegisterCallbacks` with an altitude of 1203, for both `PsProcessType` and `PsThreadType`. These intercept requests to open process and thread handles. If the target process is protected, the driver **reduces the access rights granted to the requesting process**, preventing operations such as process termination, code injection and other manipulation. In this sample the protected process is the injected CoolClient code running inside `synchost.exe`.

**Process and image load callbacks.** Registered via `PsSetCreateProcessNotifyRoutineEx` and `PsSetLoadImageNotifyRoutine`. When a process is created, its image name is compared against the configuration lists. The driver also performs a **one-time enumeration of all active processes** after registering the callbacks, so processes already running before the driver initialised are tracked too.

**Filesystem minifilter.** The driver creates the required minifilter registry entries under `HKLM\SYSTEM\CurrentControlSet\Services\msagent\Instances`, and to avoid altitude conflicts it **dynamically assigns an altitude and retries registration until it obtains a unique value**. During filesystem operations the minifilter compares accessed paths against its internal lists and denies access to matching entries.

![Minifilter registration](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13151049/honeymyte9.png align="center")

*Retrying minifilter registration with incrementing altitude values until* `FltRegisterFilter` *succeeds (source: Kaspersky GReAT).*

**Registry callback.** Registered via `CmRegisterCallbackEx` with an altitude of 320000. For enumeration requests, matching keys and values are **removed from the results before they are returned to user mode**. For direct access — opening, modifying or deleting — the callback returns `STATUS_ACCESS_DENIED`.

One important nuance: before applying these restrictions, the driver checks whether the requesting process is trusted. Processes registered through IOCTL `0x222120`, including CoolClient's own user-mode component, **bypass the filtering logic entirely and retain unrestricted access**.

### Kernel Module Hiding and the Nsiproxy Hook

To support kernel module hiding, the driver resolves the address of the non-exported kernel variable `PsLoadedModuleList` at runtime using `MmGetSystemRoutineAddress`. When a matching module is found, the driver unlinks its entry by updating the Flink and Blink pointers — the hidden module no longer appears in standard kernel module enumeration routines.

![Nsiproxy hook](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/13151315/honeymyte12.png align="center")

*Installing the Nsiproxy hook by resolving* `\Driver\Nsiproxy` *and replacing the original handler with the driver's filtering routine (source: Kaspersky GReAT).*

But the piece that should concern defenders most is the **Nsiproxy hook**. The driver obtains a reference to `\Driver\Nsiproxy` via `ObReferenceObjectByName` and replaces one of Nsiproxy's handler pointers with its own filtering routine. The hook preserves the original handler and forwards execution after processing the returned data.

When the hooked routine processes network information, the driver compares the returned entries against its registered C2 address list. **Matching IP addresses are removed before the data reaches user mode**, preventing applications that rely on Nsiproxy-provided network information from seeing the malware's C2 addresses.

* * *

## 33 IOCTL Handlers — But the Sample Uses Three

This is the section I consider most important for TI teams, and the place where reading the original report rather than a summary makes the difference.

The driver creates a device object named `\Device\ToolTool` with the symbolic link `\DosDevices\ToolTool`, and implements **33 IOCTL handlers**. The analysed CoolClient sample uses **three** of them during normal execution:

| IOCTL | Purpose |
| --- | --- |
| `0x222120` | Registers the current CoolClient process with the driver as a trusted process |
| `0x2221E0` | Sends the configured C2 IPv4 address to the driver |
| `0x2220F0` | Registers filesystem and registry paths to be protected or hidden |

The remaining thirty handlers **were not invoked by this sample**. But they exist, and the list shows `msagent.sys` is not a narrowly designed hiding component:

```plaintext
0x222000   Enable or disable the rootkit
0x222134   Inject shellcode into a target process using NtCreateThreadEx
0x222138   Hide a kernel module by unlinking it from PsLoadedModuleList
0x222144   Delete a file
0x222168   Unmap the image section of a target process
0x22216C   Terminate a process by PID
0x222194   Remove Protected Process Light (PPL) protection
0x2221A4   Hide a module within a process
0x2221AC   Enumerate and restore kernel notification callbacks
0x2221B0   Disable or restore kernel notification callbacks
0x2221B4   Manually load a secondary kernel driver
0x2221BC   Write to an arbitrary kernel address
0x2221C0   Enable deny-rootkit mode via image-load monitoring
```

Two entries deserve separate emphasis, because they target the technical foundations modern EDR depends on.

**Removing PPL protection** (`0x222194`). Protected Process Light is the Windows mechanism shielding sensitive processes — including those of many EDR products — from interference by other processes, even privileged ones. A kernel driver able to strip PPL can open the way to terminating or tampering with the security tooling itself.

**Disabling kernel notification callbacks** (`0x2221B0`). These are precisely the mechanism EDR uses to receive process creation, image load and other system events — the same class of callback this driver registers for itself above. The ability to disable them means EDR can be made to **stop receiving events** without any EDR process being terminated.

**The conclusion for TI teams:** this is the gap between *capability* and *observed behaviour*. Kaspersky did not see the sample invoke those handlers during normal execution, but their presence changes how the risk should be assessed.

If `msagent.sys` appears on a machine in your environment, **assume the driver's full capability rather than the three observed IOCTLs**. That the actor did not reach for them in this sample says nothing about whether they will in another intrusion.

* * *

## Why This Is Hard for Defenders

Four direct consequences of the driver running:

**Network information is not trustworthy.** User-mode tools inspecting connection information may **not see** the C2 address, even though the connection exists. `netstat`, Process Explorer and user-mode EDR agents all obtain their data through Nsiproxy. The connection is still there — the rootkit simply interferes with what security software and analysts are permitted to observe.

**Protected processes cannot be touched.** Object callbacks reduce handle access rights, blocking both process termination and code injection. A security tool attempting to stop the process receives an access error rather than a result.

**Files and registry objects vanish from enumeration.** The minifilter and registry callback filter results before they return, and deny direct access outright.

**Kernel modules can be unlinked.** The driver can conceal itself from standard module enumeration routines.

The operational consequence Security Affairs frames accurately: **finding** `Sang.exe`**,** `defender.exe` **or** `libngs.dll` **is no longer enough.** Investigators must also examine drivers, services, registry changes and unusual network activity — and, more importantly, **collect that data from outside the host**.

* * *

## Indicators of Compromise

> Indicators taken from Kaspersky's GReAT report of 14 August 2026. Domains are defanged.

**Sample hashes**

```plaintext
2d7c8780e97409770a9d4f31c66c9d63    msagent.sys    (kernel-mode driver)
9460E150E1981D5C165043520C5C12FE    msagent.sys    (kernel-mode driver)
9717F005C5FB98E08D2AD983D88F94EE    libngs.dll     (first-stage loader)
F518D8E5FE70D9090F6280C68A95998F    libngs.dll     (first-stage loader)
EB79558B037669792652A816E2C669DE    ctxmui.dll
```

**C2 domains**

```plaintext
cloudtroe.giize[.]com
employers.theworkpc[.]com
freeread.casacam[.]net
us.lenovoappstore[.]com
sundanish.freeddns[.]org
torinarlabs.webredirect[.]org
news.dursamjbataar[.]org
video.dursamjbataar[.]org
black-popular[.]com
whatismybestthing[.]com
```

> Note the naming pattern: several use free dynamic DNS services (`giize.com`, `casacam.net`, `freeddns.org`, `webredirect.org`), and `us.lenovoappstore[.]com` impersonates hardware vendor infrastructure.

**Observed installation paths**

```plaintext
C:\Program Files\microsoft\windows defender\
C:\Program Files\windows media player\mediares\
C:\ProgramData\symantecdir\
C:\ProgramData\virtualstore\
C:\Windows\identitycrl\production\
C:\Windows\serviceprofiles\networkservice\
C:\Users\<user>\AppData\Local\viber24.8\
C:\Users\<user>\AppData\Roaming\dsassistant\
C:\Program Files\common files\microsoft shared\office14\
C:\programdata\msdn\
```

**Component filenames**

```plaintext
defender.exe / Sang.exe     Legitimate Sangfor application, abused
libsrapc.dll                Benign bundled dependency
libngs.dll                  First-stage loader (malicious)
loadcert.ini                Encrypted second-stage DLL
cert.ini                    Final-stage implant
time.ini                    Configuration file
msagent.sys                 Kernel-mode driver
```

**Registry artifacts**

```plaintext
# AutoRun
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\goopdate
  -> launches Sang.exe or defender.exe with the "work" parameter
 
# Services
media_updaten                                    CoolClient user-mode service
msagent                                          Kernel-mode driver service
HKLM\SYSTEM\CurrentControlSet\Services\msagent\Instances    Minifilter entries
 
# Rootkit configuration
\REGISTRY\MACHINE\SYSTEM\RNG
  Hid_State, Hid_StealthMode                     REG_DWORD
  Wid_H1deF5Dirs, Wid_H1deF5Files                REG_MULTI_SZ
  Wid_H1deRegKeys, Wid_H1deRegValues             REG_MULTI_SZ
  Hid_IgnoredImages, Hid_ProtectedImages         REG_MULTI_SZ
```

**Kernel and device artifacts**

```plaintext
\Device\ToolTool                Driver device object
\DosDevices\ToolTool            Symbolic link
\\.\msagent                     User-mode path to open the device
 
# IOCTLs used during normal execution
0x222120    Register trusted process
0x2221E0    Register C2 IPv4 address
0x2220F0    Register protected paths
 
# Callback altitudes
1203        Object callbacks (ObRegisterCallbacks)
320000      Registry callback (CmRegisterCallbackEx)
```

**Driver signing certificate**

```plaintext
Subject      Nanjing Ranyi Technology Co., Ltd.
Serial       3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD
Validity     August 2013 – September 2014
```

**Behaviour to hunt**

```plaintext
# Before the driver loads — the most truthful vantage point
wmic ... MSFT_MpPreference call Add ExclusionPath="..."
xcopy copying the Windows Defender directory contents to another path
schtasks /create /sc onstart ... /ru "system"  with a fake Windows Defender service name
Sangfor executables (Sang.exe) outside the standard Sangfor installation directory
Processes checking for 360sd.exe, zhudongfangyu.exe, 360desktopservice64.exe
 
# During the execution chain
synchost.exe created suspended and then written to
Connections to ncalrpc endpoint 201ef99a-7fa0-444c-9399-19ba84f12a1a
winver.exe or computerdefaults.exe created and immediately terminated
Installation of a new driver signed with a certificate expired before 2015
```

* * *

## MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | Observed in campaign |
| --- | --- | --- | --- |
| Defense Evasion | **T1014** | **Rootkit** | `msagent.sys` hiding processes, files, registry, modules and network data |
| Persistence | T1574.002 | Hijack Execution Flow: DLL Side-Loading | `Sang.exe` sideloading `libngs.dll` |
| Defense Evasion | T1553.002 | Subvert Trust Controls: Code Signing | Driver signed with a valid 2013–2014 certificate |
| Defense Evasion | T1562.006 | Impair Defenses: Indicator Blocking | Nsiproxy hook filtering C2 addresses from network data |
| Defense Evasion | T1562.001 | Impair Defenses: Disable or Modify Tools | Adding Microsoft Defender exclusions |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service | `media_updaten` and `msagent` services |
| Persistence | T1547.001 | Registry Run Keys / Startup Folder | AutoRun entry `goopdate` |
| Persistence | T1053.005 | Scheduled Task | SYSTEM-privileged startup task named after Windows Defender ATP |
| Privilege Escalation | T1548.002 | Abuse Elevation Control Mechanism: Bypass UAC | RPC-based UAC bypass |
| Defense Evasion | T1134.004 | Access Token Manipulation: Parent PID Spoofing | Duplicated process handle assigned as parent |
| Defense Evasion | T1055 | Process Injection | Injection into suspended `synchost.exe` |
| Defense Evasion | T1112 | Modify Registry | Rootkit configuration under `\SYSTEM\RNG` |
| Defense Evasion | T1564 | Hide Artifacts | Hiding files, directories, registry keys and values |
| Defense Evasion | T1036.005 | Masquerading: Match Legitimate Name or Location | Fake Windows Defender directory, `defender.exe`, `msagent.sys` |
| Defense Evasion | T1027 | Obfuscated Files or Information | XOR keystream, control flow flattening, dummy exports |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | Decrypting `loadcert.ini`, `time.ini`; LZMA decompression |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery | Checking for 360 Total Security processes |
| Discovery | T1082 | System Information Discovery | CoolClient system reconnaissance |
| Collection | T1056.001 | Input Capture: Keylogging | Existing CoolClient capability |
| Collection | T1115 | Clipboard Data | Capability added in the 2025 variant |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols | `cert.ini` C2 communication |
| Command and Control | T1105 | Ingress Tool Transfer | CoolClient deployment via PlugX |

* * *

## Assessment

**A rootkit does not make malware stronger. It makes your tooling weaker.**

This is the point I consider most important, and it deserves stating plainly because it changes how an investigation should be approached. An implant running entirely in user mode can be very capable, but defenders still have many opportunities to inspect processes, files, handles and network activity. A kernel component actively filtering those views **changes the nature of the detection problem**.

Standard incident response rests on an implicit assumption: the data you collect from a host is accurate data. You run a process enumeration tool, you trust the result. You look at network connections, you trust the list. That assumption breaks here, and the worst part is that **it breaks silently** — no error message, no indication that you are looking at a filtered list.

**On the certificate expired since 2014.** That a driver signed with a certificate over a decade expired still loads is worth flagging to operations teams. The technique is old but effective, and it produces a very specific recommendation: **enable the Microsoft Vulnerable Driver Blocklist**, and for higher-assurance environments, consider WDAC with signer-based driver blocking. This is the kind of control many organisations already hold a licence for but have not turned on.

**The best detection points sit before the driver loads.** After the driver installation step, everything you see from the host has passed through the attacker's filter. Before that step, the chain leaves a series of clear traces:

*   The `wmic` command adding Defender exclusions — running before any malicious file touches disk
    
*   `xcopy` copying Windows Defender directory contents to another path
    
*   A SYSTEM-privileged scheduled task named to impersonate a Windows Defender service
    
*   A Sangfor executable outside the standard Sangfor installation directory
    
*   Installation of a new driver signed with a pre-2015 certificate None of these requires prior knowledge of a malware name, and none is concealed by the rootkit because they occur before the rootkit exists.
    

**On data collection.** In an environment suspected of hosting a kernel rootkit, the most trustworthy data is data that **does not come from that host**: netflow, firewall logs, infrastructure-level DNS logs, and memory images captured with tooling operating below the driver. The ten C2 domains in the report have exactly this value — you hunt them in infrastructure DNS logs, not on the suspect machine.

### Relevance for Vietnam

**To state it plainly first:** Kaspersky lists victims in Myanmar, Mongolia, Pakistan and Russia. **Vietnam is not among them in this activity**, and we draw no inference beyond the available data.

Two points are still worth a domestic TI team's attention.

**First, the regional targeting profile.** HoneyMyte, under the name Mustang Panda, has a heavy history of targeting Southeast Asia according to prior reporting from Sophos (2022) and Trend Micro (2023), with government and research organisations as focal points. Myanmar appears in this campaign's victim set. For domestic organisations with equivalent functions, this is a capability worth carrying in the threat model rather than news about a distant region.

**Second, the abuse of Sangfor binaries.** This chain uses a legitimate Sangfor executable as its sideloader. Sangfor is a security vendor with products present in the region, making this a concrete and immediately actionable review item: **check whether your organisation has any Sangfor executable outside its standard installation directory**. A validly signed legitimate binary sitting in the wrong location warrants investigation regardless of which campaign it belongs to.

It is also worth noting that Kaspersky's published installation path list shows the actor does not fix on a single location — they use directories impersonating Symantec, Windows Media Player, Office 14, Viber and ProgramData. Hunting for one specific path will miss cases; hunting for **legitimate binaries in anomalous locations** is the more durable approach.

* * *

## Recommendations

*   **Enable the Microsoft Vulnerable Driver Blocklist** across all Windows endpoints, and for higher-assurance environments deploy WDAC with signer-based driver blocking — the certificate signing this campaign's driver expired in 2014.
    
*   **Alert on Microsoft Defender exclusion paths being added via** `wmic` **or PowerShell** — this is the earliest step in the chain and the only one guaranteed not to be concealed by the rootkit.
    
*   **Hunt for validly signed binaries outside their standard installation directories**, particularly Sangfor executables, rather than hunting one specific path — the actor rotates across many impersonated directories.
    
*   **Monitor new driver installations**: new kernel-mode services, entries under `Services\*\Instances`, and drivers signed with pre-2015 certificates.
    
*   **In environments suspected of compromise, do not trust host-derived data:** corroborate network connections using netflow, firewall logs and infrastructure-level DNS logs, because user-mode network information may already be filtered.
    
*   **If** `msagent.sys` **is found, assume the driver's full capability** — including PPL removal and disabling kernel notification callbacks — rather than only the three IOCTLs observed in this sample.
    

* * *

## References

*   Kaspersky GReAT — [APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit](https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/), Fareed Radzi (14 August 2026) — original report
    
*   Security Affairs — [Mustang Panda Upgrades CoolClient With a Kernel Rootkit](https://securityaffairs.com/197274/apt/mustang-panda-upgrades-coolclient-with-a-kernel-rootkit.html), Pierluigi Paganini (16 August 2026)
    
*   Kaspersky GReAT — [HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns](https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/) (2025)
    
*   Kaspersky GReAT — [HoneyMyte kernel-mode rootkit in ToneShell](https://securelist.com/honeymyte-kernel-mode-rootkit/118590/)
    
*   Sophos — [Family Tree: DLL sideloading cases may be related](https://www.sophos.com/en-us/blog/family-tree-dll-sideloading-cases-may-be-related) (2022) — first CoolClient disclosure
    
*   Trend Micro — [Earth Preta Updated Stealthy Strategies](https://www.trendmicro.com/en_gb/research/23/c/earth-preta-updated-stealthy-strategies.html) (2023)
    
*   Google Project Zero — [Calling Local Windows RPC Servers from .NET](https://projectzero.google/2019/12/calling-local-windows-rpc-servers-from.html) — the RPC technique this chain adapts
    
*   MITRE ATT&CK — [T1014: Rootkit](https://attack.mitre.org/techniques/T1014/)
    
*   MITRE ATT&CK — [T1562.006: Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)