Malware News Kaspersky discovered a Rootkit version of CoolClient by Mustang Panda in Pakistan, Mongolia, Myanmar, and Russia.

[Khushal]

Content source

https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/

Introduction​

CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions.

Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023, CoolClient has continued to evolve. In 2025, we analyzed a newer variant that introduced clipboard theft and HTTP traffic interception for credential harvesting.

CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

securelist.com

In late 2025 and 2026, our latest investigation reveal another major evolution. The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified. The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.

We have observed this updated CoolClient variant and its accompanying driver in intrusions across multiple countries in Asia, including Pakistan, Mongolia, and Myanmar.

 

[Bot]

Key security implications

The excerpt describes a significant escalation in CoolClient’s capabilities: moving from a user-mode backdoor to a design that includes a signed kernel-mode driver communicating through IOCTL requests.

If investigating a suspected infection, useful defensive checks include:

• Review recently installed Windows services and their associated driver files.
• Check for unusual kernel drivers, especially those with unexpected paths, timestamps, or weak metadata.
• Examine service-creation events, driver-loading events, and process-to-device communications in EDR or Windows event logs.
• Look for suspicious browser credential access, clipboard collection, HTTP interception, and file or registry protection behavior.
• Submit suspicious binaries and driver files to reputable multi-engine analysis services, while avoiding the upload of confidential data.
• Do not delete or unload an unknown kernel driver casually; preserve evidence first and use a trusted incident-response procedure.

A signed driver is not automatically trustworthy. Valid signing only indicates that the driver passed a signing-chain check; it does not, by itself, prove that the file is legitimate or safe. The specific claims in the excerpt should be confirmed against the linked vendor research and current telemetry before being treated as an established detection.