Mustang Panda Strengthens CoolClient with a Hard-to-Detect Kernel Rootkit

New variant observed in Pakistan, Mongolia, and Myanmar

On August 16, 2026, Kaspersky published an analysis of a new CoolClient variant, a backdoor associated with HoneyMyte, also known as Mustang Panda.

The main addition is msagent.sys, a signed Windows driver that operates in kernel mode. The component is installed as a service and communicates with the user-mode backdoor through IOCTL requests. This allows CoolClient to hide processes, files, registry keys and values, kernel modules, and network connection information.

The analyzed intrusions affected Pakistan, Mongolia, and Myanmar. The broader victim set also includes Russia and confirmed government entities.

CoolClient became publicly known in 2022, when it was analyzed by Sophos. Trend Micro published a further analysis in 2023, while in 2025 Kaspersky documented the addition of clipboard theft and HTTP traffic interception for credential theft.

The latest variant retains these capabilities and adds kernel-level control. In the Myanmar case, the operators used PlugX as the initial post-compromise implant before subsequently installing CoolClient.

An infection chain designed to look legitimate

Before execution, the operators added Microsoft Defender exclusions for a spoofed directory and for the executable used to load the malicious DLL.

The created directory imitates the Windows Defender path:

Microsoft\Windows Defender

A legitimate Sangfor executable, normally named Sang.exe, is placed inside and renamed defender.exe. The program loads the malicious libngs.dll through DLL sideloading, a technique that abuses the expected behavior of a trusted application to execute unauthorized code.

The user-mode chain consists of several components:

• libngs.dll, the initial loader;
• loadcert.ini, the encrypted second stage;
• cert.ini, the final backdoor;
• time.ini, the configuration file.

The spoofed DLL exports functions that mimic those of the original component. The fake functions call OutputDebugStringA and exit, while the malicious code is launched from DllMain. The loader then decrypts loadcert.ini and loads it directly into memory.

For persistence, the malware can create a scheduled task that launches defender.exe with SYSTEM privileges. It can also add an AutoRun entry or install the backdoor as a Windows service. Before selecting the latter method, it checks for security products, including several 360 Total Security processes.

CoolClient also prepares privilege escalation and payload injection into synchost.exe. The procedure combines RPC with parent-process spoofing, making the malicious process appear to be a child of a legitimate process and reducing the likelihood that the user will see an administrative prompt.

After escalation, the backdoor extracts the compressed msagent.sys driver, installs it as a service, and loads it into the kernel.

How msagent.sys alters Windows’ view of the system

CoolClient uses IOCTL requests to configure the driver. Through these commands, it can register its own process as trusted, provide the IPv4 address of the command-and-control server, and specify which processes, files, and registry keys should be hidden or protected.

The driver reads part of its configuration from:

\REGISTRY\MACHINE\SYSTEM\RNG

To conceal kernel modules, msagent.sys dynamically locates PsLoadedModuleList through MmGetSystemRoutineAddress. This structure contains the list of loaded drivers; removing entries from it prevents standard tools from displaying selected modules.

To hide processes, the driver locates the ActiveProcessLinks field in the Windows EPROCESS structure. It can unlink a process from the active process list and restore it later. Dynamically locating the field avoids relying on a fixed offset that could change across Windows versions.

The driver also registers callbacks for objects, processes, and image loading. This allows it to restrict access to protected processes, including code running in synchost.exe. A program attempting to open that process or one of its threads may receive reduced permissions, making termination and code injection difficult.

File protection uses a filesystem minifilter. Filesystem operations are compared against a list of protected paths and, when they match, access may be denied. A similar mechanism protects the registry: certain keys and values are omitted during enumeration, while attempts to open, modify, or delete them may return STATUS_ACCESS_DENIED.

A broader-than-necessary kernel toolkit

The sample contains 33 IOCTL handlers, although only three were observed during normal operation. The others reveal capabilities potentially available to the operators:

• shellcode injection;
• process termination;
• removal of PPL protection;
• modification of registry values;
• disabling kernel notification callbacks;
• loading additional drivers;
• writing to arbitrary kernel addresses;
• hiding processes and modules.

Kaspersky did not observe all of these capabilities being activated. Their presence nevertheless indicates that msagent.sys is more than a simple file- or process-hiding component: it is a kernel toolkit that can expand control over the host according to the operator’s needs.

The driver also affects connection visibility. It filters information returned by Nsiproxy, the Windows component that exposes part of the network data to user-mode processes. CoolClient sends the IPv4 address of its C2 server to the driver; msagent.sys can then remove that association before the information is returned to diagnostic tools.

The connection to the command-and-control infrastructure can therefore remain active while user-mode network utilities fail to display the associated address.

What security teams should check

Searching only for Sang.exe, defender.exe, or libngs.dll is not sufficient. An investigation should also cover Windows services, loaded drivers, scheduled tasks, AutoRun keys, and exclusions configured in Microsoft Defender.

Relevant items to examine include:

• defender.exe, Sang.exe, libngs.dll, loadcert.ini, cert.ini, time.ini, and msagent.sys;
• changes to \REGISTRY\MACHINE\SYSTEM\RNG;
• anomalies in processes and modules associated with synchost.exe;
• UAC bypass attempts, RPC activity, and parent-process spoofing;
• DLL sideloading activity;
• drivers signed with the certificate associated with Nanjing Ranyi Technology Co., Ltd.;
• indicators linked to PlugX and CoolClient.

The certificate used by the driver was valid from 2013 to 2014. Other malicious drivers using the same certificate have been identified, but no direct connection to CoolClient has been established. References in PDB strings, such as “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” likewise do not by themselves prove the developer’s identity or involvement by any specific country.

Containment should rely on sources independent of user mode alone. Process, module, file, registry, and network enumerations should be cross-checked using offline tools or collections performed from a trusted environment. The apparent removal of the backdoor does not mean the system is clean if the driver or other persistence mechanisms remain present.

No specific patch for CoolClient has been identified. It is also unknown whether this threat or variant has been added to CISA’s Known Exploited Vulnerabilities catalog or whether any associated deadline exists.

The use of the kernel changes the threat’s operational profile: CoolClient no longer merely spies on systems and manages files, but can alter what Windows makes visible to security tools.