Mustang Panda Deploys Signed Kernel-Mode Rootkit with CoolClient Backdoor

The threat actor HoneyMyte (also known as Mustang Panda) has been observed enhancing its CoolClient backdoor with a sophisticated, signed Windows kernel-mode rootkit, identified as msagent.sys. This rootkit provides deep stealth capabilities, including the ability to hide processes, files, registry objects, and C2 network information from security tools. The driver is deployed when the malware gains sufficient privileges (Service Control Manager access and SeTcbPrivilege) during the post-compromise phase. This development represents a significant evolution in the group's evasion tactics, allowing the backdoor to maintain persistence and protect its presence on infected systems in Myanmar, Mongolia, Pakistan, and Russia. The rootkit leverages kernel notification callbacks and hooks within the Nsiproxy driver to filter system-level activity, indicating a high level of technical proficiency and commitment to long-term espionage.

Attack Chain

1. Initial access is achieved via a primary implant, typically PlugX, which prepares the environment.
2. The actor creates a fake Windows Defender installation directory and deploys a legitimate, renamed Sangfor executable to facilitate DLL sideloading.
3. Persistence is established via a scheduled task that executes the renamed defender.exe with SYSTEM privileges at startup.
4. The legitimate binary loads a malicious libngs.dll, which decrypts and executes the second-stage component loadcert.ini.
5. The second-stage component performs UAC bypass and process injection, eventually injecting into a legitimate process such as synchost.exe.
6. If adequate privileges are met, the malware extracts and drops the signed msagent.sys driver to the disk.
7. The driver is installed as a Windows service named 'msagent' and communicates with the user-mode CoolClient via IOCTL requests (e.g., 0x222120, 0x2221E0, 0x2220F0) to register protected paths and C2 information.
8. Final-stage activity involves keylogging, clipboard theft, and C2 communication, all protected by the kernel-mode rootkit.

Impact

HoneyMyte's use of this rootkit significantly complicates incident response and detection efforts. By unlinking processes from the active process list and filtering network information at the Nsiproxy level, the malware effectively blinds traditional endpoint security tools. Confirmed victims include government entities across several regions, suggesting a focus on long-term espionage and sensitive data exfiltration.

Recommendation

• Monitor for the installation of new kernel-mode drivers using Sigma rules tracking service creation where the binary is not part of a known-good software update cycle.
• Utilize the provided MD5 hashes to hunt for the identified msagent.sys and libngs.dll files in disk forensic images.
• Audit scheduled tasks and services for atypical binaries renamed to mimic system or legitimate vendor executables (e.g., 'defender.exe' in custom directories).
• Enable and aggregate kernel-level telemetry (e.g., Microsoft-Windows-Kernel-Driver event logs) to identify the registration of new driver services.
• Deploy detections for suspicious IOCTL communication patterns originating from user-mode processes to kernel-mode drivers, focusing on the identified IOCTL codes.