In short: On August 14, 2026, Kaspersky GReAT disclosed a new cyber-espionage campaign: Chinese APT group HoneyMyte (Mustang Panda) has added a signed Windows kernel-mode rootkit to its CoolClient backdoor. Confirmed victims include government entities in Russia, Myanmar, Mongolia, and Pakistan. The rootkit hides processes, files, and C2 server addresses, making infections nearly undetectable by conventional security tools.
What Happened
Kaspersky GReAT researcher Fareed Radzi published a detailed report on August 14, 2026, analyzing an upgraded campaign by HoneyMyte — also known as Mustang Panda, Bronze President, and TA416. Active since 2012, the group has consistently targeted government, military, scientific, and telecommunications organizations across Asia. This campaign introduced a fundamentally upgraded version of its primary tool, the CoolClient backdoor. For an overview of how network-level encryption protects your data, see the LiMP VPN features page.
The critical addition is a kernel-mode rootkit: a malicious driver (msagent.sys) bearing a legitimate digital signature operates at the Windows kernel level. A valid signature allows it to bypass Driver Signature Enforcement — the protection in modern Windows that blocks unsigned kernel drivers from loading.
How the Attack Works: From PlugX to Kernel Rootkit
The infection proceeds in two stages. First, the victim is compromised by PlugX — a widely-used implant associated with multiple Chinese APT groups. PlugX establishes persistence and prepares the system for CoolClient delivery. In the second stage, CoolClient is deployed via DLL sideloading: a legitimate Sangfor application, renamed to defender.exe, loads a malicious DLL in place of its legitimate library.
Once installed, CoolClient activates the msagent.sys kernel rootkit, which registers 33 IOCTL control handlers and intercepts multiple critical Windows kernel hooks:
- Process hiding — CoolClient's entry is removed from the Active Process List, making it invisible to Task Manager and Process Monitor.
- File and registry hiding — all malware artifacts on disk and in the registry are filtered from standard queries.
- Network connection masking — the rootkit hooks the Nsiproxy.sys driver to filter network connection data, hiding C2 server IP addresses from analysis tools.
What CoolClient Steals
The backdoor covers the full spectrum of espionage capabilities:
- Keylogging — recording all keystrokes, including passwords.
- Clipboard theft — capturing copied text, including one-time passwords.
- HTTP traffic interception to harvest credentials from unencrypted connections.
- File system management — uploading and downloading arbitrary files.
- System reconnaissance — process lists, installed software, network configuration.
- Plugin support for additional capabilities on demand.
Russia Among Confirmed Victims
Kaspersky GReAT confirmed infections in Myanmar, Mongolia, Pakistan, and Russia, explicitly noting that government entities are among the victims. HoneyMyte has historically targeted government agencies, defense-industrial organizations, research institutions, and telecom providers — entities of geopolitical interest to China. A similar Chinese APT tactic was employed in the LightSpy campaign we covered earlier: Chinese LightSpy spyware active in 13 countries. Related context on covert implants: OctLurk and SilkLurk memory-only backdoors.
Why a Kernel-Mode Rootkit Is Especially Dangerous
A kernel-mode rootkit represents a fundamentally different threat category from conventional malware. Standard antivirus operates in user space and cannot reliably detect an implant that hides itself at the kernel level. The traditional indicators of compromise — suspicious processes, files, network connections — become invisible to the very tools designed to find them.
For enterprise defenders, this underscores the need for EDR solutions with kernel-level visibility. The initial infection vector — PlugX — most commonly spreads via spear-phishing emails and infected USB devices.
How to Reduce Your Risk
- Enforce application allowlisting. An application control policy prevents sideloaded DLLs outside an approved list from executing.
- Deploy kernel-level EDR. Conventional antivirus cannot see what a kernel rootkit hides; kernel-aware behavioral analytics is the minimum baseline for organizations in high-risk categories.
- Keep Windows updated. Microsoft regularly revokes compromised driver certificates via WDAC updates (KB5029775).
- Encrypt your traffic. A VPN cannot remove an already-installed rootkit, but WireGuard-encrypted traffic significantly raises the cost of credential interception and network reconnaissance. LiMP VPN supports WireGuard on iOS and Android.
- Be cautious with attachments and USB devices. PlugX — the first infection stage — spreads primarily through phishing and removable media. Email hygiene and USB policies are the first line of defense.