APT Group HoneyMyte Deploys Kernel‑Level Rootkit in CoolClient Backdoor
What Happened — The HoneyMyte (Mustang Panda) APT group released a new CoolClient variant that installs a signed kernel‑mode driver (Msagent.sys) as a Windows service. The driver communicates with the user‑mode backdoor via IOCTL, hides the malicious process, files, and registry keys, and bypasses UAC to maintain persistence.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a failure of SOC 2 Access Controls – privileged‑account abuse and lack of driver‑whitelisting allow a malicious kernel component to run with SYSTEM rights.
- Highlights the need for continuous monitoring of privileged actions (driver installations, service creations) as audit evidence of control effectiveness.
- Reinforces the importance of Security Awareness Training so users recognize initial infection vectors (e.g., PlugX, fake Defender installers) that lead to kernel compromise.
Who Is Affected — Enterprises in Asia and Russia across sectors such as finance, technology, telecommunications, and government that run Windows endpoints and rely on standard AV exclusions.
Recommended Actions
- Map the driver‑installation and service‑creation steps to SOC 2 CC6.1 (System Operations) and CC6.2 (Change Management) controls; collect logs as evidence.
- Deploy endpoint detection that monitors unsigned driver loads, new services, and abnormal IOCTL traffic.
- Refresh security‑awareness curricula to cover APT tactics: malicious exclusions, disguised installers, and kernel‑mode persistence.
Technical Notes – The attack chain starts with PlugX, adds Defender‑related exclusions via MSFT_MpPreference, injects synchost.exe, then drops Msagent.sys. The driver registers MiniFilter and registry callbacks, hides its own objects, and intercepts network traffic via Nsiproxy hooking. Source: SecureList – Kaspersky