Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Brief
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect.
HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection.
That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove.