The intrusion chain involves the use of PlugX as an initial post-compromise implant to facilitate the deployment of CoolClient components. The threat actor actively modifies Microsoft Defender exclusions to evade detection before establishing persistence through scheduled tasks running with SYSTEM privileges. The malware continues its multi-stage loading process, involving heavily obfuscated components that decrypt and execute the final-stage C2 implant, now renamed to 'cert.ini'. This update, observed in intrusions across Asia, signifies a shift toward deeper kernel-level integration for long-term espionage operations.

Attack Chain

1. Initial access is gained using a PlugX implant to download and stage CoolClient components.
2. The actor adds directory and file exclusions to Microsoft Defender using 'wmic' to allow the malicious 'defender.exe' (a renamed Sangfor executable) to run undetected.
3. A scheduled task is created under the name 'Microsoft\Windows\Windows Defender Advanced Threat Protection Service' to execute 'defender.exe' with SYSTEM privileges at startup.
4. 'defender.exe' performs DLL sideloading by loading the malicious 'libngs.dll'.
5. 'libngs.dll' executes its DllMain routine to decrypt and load 'loadcert.ini' into memory.
6. The second-stage loader 'loadcert.ini' decrypts 'time.ini', deploys the kernel-mode driver as a Windows service, and injects the final-stage 'cert.ini' implant into 'synchost.exe'.
7. The driver enables rootkit features by intercepting and filtering system calls via IOCTL requests to mask the presence of CoolClient.
8. The final-stage implant establishes C2 communication to perform espionage activities.

Impact

The updated CoolClient backdoor allows HoneyMyte to maintain persistent, long-term access to compromised systems in Asia, including Pakistan, Mongolia, and Myanmar. The kernel-mode rootkit significantly hampers incident response and forensic analysis by concealing the malware's footprint, potentially leading to prolonged undetected data exfiltration and cyber-espionage.

Recommendation

1. Deploy Sigma rules to detect the creation of suspicious Microsoft Defender exclusions via WMI.
2. Monitor scheduled tasks for entries that execute binaries from non-standard or unauthorized directories, specifically targeting the identified 'Windows Defender' folder path masquerading.
3. Implement endpoint detection for unauthorized loading of kernel drivers, specifically focusing on drivers not signed by known, trusted vendors.
4. Hunt for the presence of the identified CoolClient component filenames ('loadcert.ini', 'cert.ini', 'time.ini', 'libngs.dll') within the environment.
5. Audit system services and drivers for unexpected additions or modifications, particularly those interacting with legitimate process names like 'synchost.exe'.