HoneyMyte arms CoolClient with a signed kernel rootkit that hides processes from security tools

August 14, 2026. Researchers at Kaspersky publish an analysis of a new CoolClient backdoor variant. What is new: a signed kernel driver that hides the malware’s processes, files, registry keys, and network connections. Who is behind it: HoneyMyte, the APT group better known as Mustang Panda, already tied to intrusions against governments across Asia.

The word that matters here is not “backdoor” but “kernel rootkit.” A backdoor runs and leaves traces; a kernel rootkit falsifies the reality that security tools see. The compromised machine can look perfectly healthy while the attacker works inside it.

A signed driver, four levels of invisibility

The key component is the msagent.sys driver, loaded in kernel mode and digitally signed. The signature is decisive: it lets a malicious driver pass as a legitimate component in Windows’s trust mechanisms and complicates blacklisting.

Once loaded, the driver hides four things:

• Processes: through process and image-load callbacks, it removes the malware’s processes from enumerations.
• Files: by registering as a Minifilter on the filesystem, it filters access to hide its on-disk artifacts.
• Registry keys: registry callbacks hide its persistence entries.
• Network: the command-and-control (C2) connections vanish from network state listings.

The result is a compromise that resists user-mode tooling. An EDR querying the system API sees a clean machine, because the rootkit answers requests before — or rather in place of — the operating system.

The infection chain, from DLL to driver

Kaspersky walks through the full chain. The entry point is libngs.dll, a first stage that drops the loadcert.ini configuration file. Then comes process injection into synchost.exe, a name chosen to blend into legitimate Windows noise.

Persistence is established through AutoRun, after which the malware checks for administrator privileges: if they are missing, it relaunches with elevation and a UAC bypass. Only once administrator does it install its service and deploy the kernel driver.

That progression is a lesson in itself. The rootkit is not a single dropped file: it is the culmination of a chain that climbs the privilege ladder step by step. Each stage — injection, persistence, elevation — is a point where behavioral detection could have cut the chain before the kernel was compromised.

Why a signed kernel rootkit changes the game

The difference between a userland rootkit and a kernel rootkit is the difference between an intruder hiding behind a curtain and one unplugging the cameras. The first can be found; the second controls what you are allowed to see.

The signature adds another layer of difficulty. Windows enforces kernel driver signing; a signed driver clears that barrier and reads as legitimate. The open question is who signed it — a stolen certificate, a compromised authority, or a certificate legitimately obtained through a front. Kaspersky does not detail the certificate’s origin, but an APT group holding a signed driver is a signal in itself: the signing barrier is no longer a wall, it is a formality.

For a CISO, the consequence is blunt: userland indicators — process lists, file hashes, network flows — are no longer enough. When the rootkit is active, everything those tools read is filtered.

Who is targeted, and by whom

HoneyMyte, aka Mustang Panda, is a long-documented APT group attributed to China. Its campaigns have historically targeted government, diplomacy, and telecommunications in Southeast Asia, with recent forays further afield.

The group’s profile matters for triage: security vendors have tracked HoneyMyte’s phishing lures and watering-hole campaigns across the region for years, and every iteration has added a layer of stealth. The backdoor itself has evolved from a simple remote-access tool into a modular implant, and this signed driver is its deepest layer yet — the group is investing in persistence below the EDR, not just in initial access.

The move from a simple backdoor to a kernel rootkit is a classic escalation for groups that feel detection closing in. When EDR becomes the norm, the attacker drops one level down the stack: from process to driver. That is exactly what this CoolClient variant shows.

What it changes for detection

Against a kernel rootkit, the rule is simple: telemetry must come from the kernel itself, not from the APIs it can filter. Concretely:

• Kernel telemetry: prefer sensors that run in kernel mode (kernel-level ETW, kernel callbacks), able to see what the rootkit tries to hide.
• Driver blocking: maintain a driver blocklist (WDAC, the vulnerable driver blocklist) to stop unapproved drivers from loading.
• Behavioral detection: watch the sequence — injection into synchost.exe, UAC elevation, service installation, driver loading — rather than the final file alone.

The trap is trusting the scan: a signed rootkit passes scans, and so does the malware it protects. Detection must target the infection path, not the end state.

One more practical point on triage. When a machine shows the telltale sequence — a suspicious service installed, a driver loaded right after a UAC elevation — treat the endpoint as kernel-compromised, not merely infected. The standard response of pulling files and hashes is insufficient: a machine running a kernel rootkit cannot be trusted to report its own state. The safe path is network isolation first, then forensic capture from outside the guest (via the hypervisor or a hardware-based capture), not from within a system that is actively lying to you.

The Lazarus precedent, and what it says about the trend

This rootkit is not an isolated case. Within days, Check Point Research revealed that the Lazarus group was exploiting a zero-day in Windows’s afd.sys driver to drop a new version of its FudModule rootkit. Two distinct APT groups, two kernel rootkits, in the same fortnight.

The coincidence is a signal. When EDR becomes ubiquitous, state-backed attackers do not give up — they move below the layer the EDR watches. Kernel mode becomes the playground, and driver signing the price of entry. For defenders, that means kernel visibility is no longer a luxury: it is the minimum required to see what APT groups are deploying today.

The parallel also clarifies HoneyMyte’s strategy. Where Lazarus breaks a legitimate driver to elevate, HoneyMyte ships a signed driver ready to use. Two paths to the same goal — running code underneath the EDR — and two reminders that trust in signatures and allow-lists has to be revisited from the ground up.

Verdict

If you defend governments or critical infrastructure in Asia, treat this CoolClient variant as an immediate-perimeter threat: Mustang Panda targets exactly that profile, and the rootkit is built to survive conventional EDR.

If you manage a Windows fleet, harden driver loading — WDAC and the vulnerable driver blocklist cost little and cut the rootkit’s most direct path. Add kernel telemetry to your SOC: without it, a machine compromised by this rootkit is undetectable by construction.

The underlying signal: the race between EDR and APT is moving into the kernel. When the attacker controls the layer that filters your visibility, the only defense is to measure below it — and to cut its installation path before it gets there.

References

• Kaspersky Securelist — CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit, August 2026
• The Hacker News — Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth, August 14, 2026
• SecurityAffairs — Mustang Panda Upgrades CoolClient With a Kernel Rootkit, August 16, 2026