The Chinese threat group HoneyMyte has deployed an updated version of the CoolClient backdoor equipped with a digitally signed Windows kernel-mode rootkit capable of concealing malicious processes, files, registry objects, and command-and-control network data. Russian cybersecurity firm Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, with CoolClient consistently installed as a secondary backdoor following a PlugX infection. The kernel component is deployed when CoolClient has full access to the Service Control Manager and the SeTcbPrivilege privilege; if those conditions aren't met, the malware skips driver deployment and proceeds to the final-stage implant.

According to Kaspersky's analysis, the latest CoolClient variant can install the driver as a Windows service and control it from the user-mode backdoor through input/output control requests. The malware supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and additional functionality delivered through plugins. The kernel driver, written to disk as msagent.sys, is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd. that was valid from August 2013 to September 2014. Kaspersky identified several older malicious drivers signed with the same certificate and compiled around 2013, though it found no evidence directly connecting those samples to the CoolClient activity. The analyzed sample invokes only three of the 33 IOCTL handlers implemented by msagent.sys during normal execution: one that registers the current CoolClient process as a trusted process with the driver, one that passes the configured C2 IPv4 address to the driver, and one that registers filesystem and registry paths that should be protected.

"Our analysis confirms that the investigated malware is a new CoolClient variant associated with the HoneyMyte threat group," Kaspersky stated. While the overall execution flow remains consistent with previously documented CoolClient variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware's stealth capabilities. The report finds that in one campaign targeting Myanmar, HoneyMyte used PlugX as the initial post-compromise implant to deploy CoolClient, adding Microsoft Defender exclusions for a fake Windows Defender installation directory and a renamed sideloading executable. The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.

The rootkit loads its stealth configuration from a registry location and uses separate configuration entries for directories, files, registry keys and values, and processes that should be hidden, protected, or ignored. For process protection, the driver can reduce the access rights granted when another process attempts to open a handle to a protected process, preventing operations such as termination and code injection; in the analyzed sample, the protected process contained CoolClient code injected into synchost.exe. The driver also implements process hiding by unlinking entries from the Windows active process list, uses a filesystem minifilter to deny access to protected files and directories, and registers a registry callback that removes protected keys and values from enumeration results and blocks attempts to modify or delete them. A separate hook installed in the Windows Nsiproxy driver filters configured C2 IPv4 addresses from network information returned to user mode. The development comes more than six months after Kaspersky disclosed that a newer CoolClient variant used in a campaign targeting Pakistan and Myanmar dropped and executed a previously unseen rootkit, as The Hacker News reported in January 2026. Kaspersky had separately documented a different HoneyMyte kernel-mode rootkit in December 2025 that was used to load the ToneShell backdoor; the company said the overall design of the new CoolClient driver is comparable to the kernel-mode enhancements seen with ToneShell, while the CoolClient component exposes dedicated IOCTL handlers for direct communication with the user-mode backdoor. The persistence of signed malicious drivers in espionage campaigns suggests that certificate validation alone can't stop determined state-aligned actors. Organizations in the targeted regions should assume that initial access has already occurred and focus defenses on detecting unusual privilege escalation and driver loading behavior.