Mustang Panda Adds Signed Kernel Rootkit to CoolClient: 4 Governments Compromised

Mustang Panda is a China-nexus advanced persistent threat group operational since at least 2012, tracked under more than a dozen aliases: HoneyMyte, Bronze President, Earth Preta, Stately Taurus, RedDelta, Camaro Dragon, TWILL TYPHOON, TA416, FIREANT, and PKPLUG, among others. MITRE ATT&CK assigns the cluster identifier G0129. Different vendor naming conventions cover the same threat actor: Microsoft calls them Twill Typhoon, CrowdStrike tracks them as Mustang Panda, and Kaspersky documents their operations as HoneyMyte.

The group's primary mission is espionage. Mustang Panda targets government ministries, diplomatic missions, think tanks, religious institutions, and military organizations across Southeast Asia, Central Asia, Europe, and Russia. The group has never been publicly sanctioned or indicted, unlike several other PRC-attributed actors including Volt Typhoon and Salt Typhoon, and it continues to operate and upgrade its tooling without apparent disruption from law enforcement.

Mustang Panda's operational signature is patience and iteration. The group reuses PlugX as an initial implant across virtually every campaign, then layers secondary backdoors (ToneShell, SnakeDisk, LOTUSLITE, and now CoolClient with its kernel rootkit) to maintain access even after initial indicators are discovered. The December 2025 Kaspersky report documented a separate HoneyMyte kernel-mode rootkit used to load the ToneShell backdoor; the August 2026 CoolClient disclosure shows the group applied the same kernel-level defense evasion capability to a second malware family in parallel.

For comparison, China-linked Red Menshen embedded BPFDoor kernel backdoors inside telecom networks across 10 countries, a parallel approach to achieving kernel-level persistence while defeating standard detection tooling.

The CoolClient kernel rootkit attack chain uses a six-stage delivery sequence. Kaspersky documented all six stages in confirmed intrusions against government entities.

Stage one: Mustang Panda deploys PlugX via spearphishing, establishing initial access inside the target organization. Stage two: the group copies CoolClient components into a directory configured with a Microsoft Defender exclusion added by PlugX, bypassing real-time antivirus scanning. Stage three: DLL sideloading executes the attack chain using a legitimate Sangfor endpoint security executable, renamed to defender.exe, that loads the malicious libngs.dll library through standard Windows DLL search order. Stage four: libngs.dll decrypts and runs loadcert.ini, which establishes persistence via an AutoRun registry entry named goopdate and a scheduled task running as SYSTEM, then uses RPC-based process creation combined with PPID spoofing to inject CoolClient code into synchost.exe. Stage five: loadcert.ini extracts the LZMA-compressed msagent.sys driver from embedded resources, installs it as a Windows service named msagent, and registers it with the kernel. Stage six: the kernel driver activates, receives three IOCTL commands from CoolClient's user-mode component, and begins hiding all rootkit artifacts.

Once active, msagent.sys provides four protection capabilities. Process protection: the driver reduces access rights on handles that attempt to open CoolClient-associated processes, preventing tools like Task Manager and Process Explorer from terminating them. Process hiding: the driver unlinks CoolClient's process entries from the Windows active process list, making the process invisible to all user-mode enumeration. File and registry hiding: a filesystem minifilter driver denies read access to protected files and registry callbacks intercept enumeration requests, preventing both manual inspection and automated scanning. Network traffic filtering: the driver hooks Nsiproxy, the Windows kernel network statistics provider, and filters the C2 IPv4 address from any query, so netstat and network monitoring tools see no connection to the attacker's server.

Government is Mustang Panda's primary target. The August 2026 CoolClient rootkit campaign confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, all of which are government entities based on Kaspersky's incident analysis. This targeting pattern is consistent with PRC intelligence priorities in Southeast Asia, Central Asia, and neighboring states.

Diplomatic organizations are secondary targets. Mustang Panda has conducted sustained campaigns against embassies, diplomatic missions, and foreign ministries across Europe and Asia, seeking intelligence on government communications and policy deliberations. The group's Operation Neusploit campaign earlier in 2026 targeted US government and policy organizations using Venezuela-themed spearphishing emails, demonstrating an active interest in Western government networks.

Religious institutions, think tanks, and non-governmental organizations round out the targeting profile. These targets provide Mustang Panda with insight into diaspora communities, political opposition movements, and international advocacy groups that the PRC treats as strategic intelligence concerns.

Mustang Panda's geographic targeting excludes mainland China. Attribution analysis of the China-nexus vCenter campaign confirmed a consistent pattern of victimology that excludes Chinese-language speakers and PRC-aligned infrastructure, a standard indicator of state-sponsored Chinese threat actor operations. The group has confirmed targeting across more than 20 countries based on cumulative incident data from Kaspersky, Trend Micro, CYFIRMA, and Mandiant.

Any organization with government, defense, or diplomatic operations in Southeast Asia, Central Asia, or Eastern Europe should treat CoolClient rootkit indicators as a live threat requiring immediate active hunting.

Mustang Panda's intrusion chain maps cleanly to 12 distinct MITRE ATT&CK techniques across the complete CoolClient rootkit campaign.

Initial access uses spearphishing attachments (T1566.001) and links (T1566.002), typically with geopolitically themed lures relevant to the target country. PlugX is the primary initial access tool; it has been Mustang Panda's preferred implant since at least 2012 and appears in virtually every confirmed intrusion as the first-stage implant before secondary backdoors are deployed.

Defense evasion drives the middle of the attack chain. DLL sideloading (T1574.002) via the renamed Sangfor executable provides initial code execution without triggering application control policies. Microsoft Defender exclusions added by PlugX (T1562.001) protect the staging directory from real-time scanning. UAC bypass (T1548.002) in the loadcert.ini component elevates privileges without prompting the user. The kernel driver then provides rootkit capabilities (T1014) for process hiding (T1564.009), file and registry hiding (T1564.012), and network traffic filtering (T1070.001).

Persistence uses both AutoRun registry modification (T1547.001, registry key "goopdate") and a scheduled task (T1053.005) configured to launch the backdoor with SYSTEM privileges at startup.

Execution uses RPC-based process creation combined with PPID spoofing (T1134.004) to inject CoolClient into synchost.exe (T1055), making the implant appear as a legitimate child of a trusted system process.

Collection capabilities include keylogging (T1056.001), clipboard theft (T1115), credential harvesting (T1056.004), file management (T1005), and system reconnaissance (T1082). All data exfiltration routes through the C2 channel hidden by the kernel driver's Nsiproxy hook.

North Korea's Lazarus Group used a comparable approach combining kernel exploits with FudModule rootkit to defeat security tools. The two-state pattern of using legitimate signed drivers for kernel-level access is now a confirmed technique in nation-state playbooks.

No Sigma rule targeting CoolClient or msagent.sys by name existed at time of publication; the campaign was disclosed publicly on August 14, 2026, and rule authors typically require several weeks to publish CVE- or campaign-specific detections. Two behavior-based rules address the core techniques in the CoolClient delivery chain: DLL sideloading via image load events and suspicious driver installation via pnputil.exe.

Both rules require Windows Sysmon event collection or equivalent EDR telemetry. The DLL sideloading rule (image_load category) fires on the appverifUI.dll sideloading pattern as a representative high-confidence template; adapt the ImageLoaded field to match libngs.dll for CoolClient-specific coverage. The driver installation rule fires when pnputil.exe installs a driver that does not match expected system paths, which covers the msagent.sys deployment.

WAF rules are not applicable to this attack. The CoolClient rootkit chain is entirely host-based: DLL sideloading, kernel driver installation, registry modification, and process injection produce no distinct HTTP request pattern that a WAF can intercept or block.

Four file hashes, one C2 domain, and one C2 IP address are confirmed indicators for the August 2026 CoolClient rootkit campaign. All six should be added to endpoint threat intelligence feeds, firewall block lists, and SIEM correlation rules before end of day.

On Windows endpoints, hunt for the msagent Windows service and for the registry configuration key that CoolClient uses to store its settings. The presence of either indicator on any host confirms an active CoolClient installation. The registry key path \REGISTRY\MACHINE\SYSTEM\RNG is documented by Kaspersky as the CoolClient configuration storage path; no legitimate Windows component writes to this exact path.

Hunt for the renamed Sangfor binary (any executable named defender.exe that is not signed by Microsoft) and for the libngs.dll library loaded by non-Sangfor processes. Standard Windows has no libngs.dll; any occurrence in process image load telemetry is malicious. Also hunt for the Windows service names goopdate (AutoRun persistence) and media_updaten (CoolClient service name), both documented as Mustang Panda persistence artifacts in the August 2026 campaign.

Block couldinstallup.com at DNS and proxy layer and null-route 199.209.141.166 at the firewall. These network indicators were published by CrowdStrike's HuntPack for Mustang Panda activity and remain active in infrastructure used by the group.

Defending against the CoolClient kernel rootkit requires addressing three surfaces: endpoint hunting (the rootkit hides itself so hunting must run before the driver activates or from a clean offline image), network blocking (C2 domain and IP), and behavioral detection (DLL sideloading and driver installation events before the rootkit goes active).

Standard EDR tools running on a live compromised system will not detect CoolClient after msagent.sys is installed because the kernel driver blocks all user-space inspection. Detection must happen at the point of installation, before the driver registers, or through offline forensic analysis of memory and disk images.