Loading malware…
CoolClient is a Windows backdoor family associated with the HoneyMyte threat actor, also widely tracked as Mustang Panda, and used in cyber-espionage operations against organizations across Asia and Russia, including government entities. It has commonly been deployed as a secondary implant after PlugX and has also appeared in broader Mustang Panda intrusion sets alongside other espionage tooling.
CoolClient is a multi-stage implant typically delivered through DLL sideloading with legitimate signed Windows software, including Sangfor applications. Observed execution chains use staged loaders and encrypted configuration data, establish persistence through Run keys, scheduled tasks, and Windows services, and inject later stages into legitimate processes. Reported variants support command-and-control over TCP and UDP, file upload and deletion, keylogging, clipboard theft, credential harvesting, system reconnaissance, packet tunneling, port mapping, and plugin-based extension for additional post-compromise functionality.
Recent variants significantly expanded stealth by adding a signed Windows kernel-mode component that functions as a rootkit. This driver can be installed as a service and controlled from user mode through IOCTL requests. Its observed functions include hiding or protecting malware-related processes, files, registry objects, and selected network information from user-mode tools. Reported kernel capabilities include process hiding, filesystem and registry filtering, object-access restriction, and network information filtering via Nsiproxy hooking. Some analyses also identified additional driver handlers suggesting broader capabilities such as shellcode injection, kernel module hiding, process termination, and arbitrary kernel memory modification, although not all of these were observed in routine execution.
CoolClient has been used in targeted post-compromise espionage activity in countries including Myanmar, Mongolia, Pakistan, and Russia. In documented campaigns, operators used PlugX as an initial foothold before deploying CoolClient, then leveraged persistence, privilege escalation, process injection, and defense-evasion measures to maintain covert access and support intelligence collection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A critical pre-authentication remote code execution vulnerability, CVE-2025-15467 (CVSS 9.8), affects OpenSSL versions 3.0, 3.3, 3.4, 3.5, and 3.6.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
HoneyMyte ... has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit ... CoolClient supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and additional functionality delivered through plugins.
This includes an unreported cluster dubbed SteppeDriver that was first discovered in 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.
The actor then created a fake Windows Defender installation directory, copied the CoolClient components into it, and renamed a legitimate Sangfor executable, usually named Sang.exe, to defender.exe to serve as the DLL sideloader. When executed, defender.exe sideloads the malicious libngs.dll, initiating the CoolClient execution chain. | Execution begins when the legitimate Sangfor application (defender.exe or Sang.exe) loads the malicious libngs.dll through DLL sideloading.
The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.
The latter handles persistence, registry modifications... The rootkit loads its stealth configuration from \REGISTRY\MACHINE\SYSTEM\RNG and uses separate configuration entries for directories, files, registry keys and values, and processes that should be hidden, protected, or ignored.
The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.
The latter handles persistence, registry modifications, User Account Control (UAC) bypass, process injection, driver deployment... it also implements a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named synchost.exe.
It also implements a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named synchost.exe.
According to Kaspersky's new analysis, the latest CoolClient variant can install the driver as a Windows service... The second-stage malware creates an AutoRun registry entry named goopdate and can install a Windows service named media_updaten.
HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.
The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading... before injecting into a process named synchost.exe.
The latter handles persistence, registry modifications, User Account Control (UAC) bypass, process injection, driver deployment... it also implements a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named synchost.exe.
Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories.
It also implements a remote procedure call (RPC)-based process creation technique combined with parent process ID (PPID) spoofing to relaunch itself in an elevated context before injecting into a process named synchost.exe.
The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.
The driver also implements process hiding by unlinking entries from the Windows active process list, uses a filesystem minifilter to deny access to protected files and directories, and registers a registry callback that removes protected keys and values from enumeration results and blocks attempts to modify or delete them.
The actor then created a fake Windows Defender installation directory, copied the CoolClient components into it, and renamed a legitimate Sangfor executable, usually named Sang.exe, to defender.exe to serve as the DLL sideloader. When executed, defender.exe sideloads the malicious libngs.dll, initiating the CoolClient execution chain. | Execution begins when the legitimate Sangfor application (defender.exe or Sang.exe) loads the malicious libngs.dll through DLL sideloading.
The latter handles persistence, registry modifications... The rootkit loads its stealth configuration from \REGISTRY\MACHINE\SYSTEM\RNG and uses separate configuration entries for directories, files, registry keys and values, and processes that should be hidden, protected, or ignored.
Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/espionage implant used by Mustang Panda that supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, plugin-based extensibility, persistence, UAC bypass, process injection, and now kernel-level stealth via a signed driver that hides and protects processes, files, registry entries, and selected network information.
Backdoor used by HoneyMyte/Mustang Panda in a multi-stage infection chain. The final implant handles C2 communications and backdoor functions, while associated stages provide persistence, process injection, UAC bypass, and deployment of a signed kernel-mode rootkit driver for stealth and protection.
A Windows espionage backdoor used in targeted intrusions that now includes a kernel-mode component. It abuses DLL sideloading via legitimate Sangfor executables, loads staged payloads from .ini files, and can deploy the signed msagent.sys driver to hide or protect malware files, registry keys, and processes. The content also notes historical backdoor and credential-theft functionality.
A backdoor used by HoneyMyte/Mustang Panda that provides keylogging, clipboard theft, credential harvesting, file management, reconnaissance, plugin-based extensibility, and C2 communications. In this variant it works with a signed kernel-mode rootkit/driver to hide and protect malicious processes, files, registry objects, and C2 network information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.