A rootkit built for evasion, not just persistence
Kaspersky researchers disclosed on August 14 that Mustang Panda, the China-linked group it tracks as HoneyMyte, has added a new kernel-mode driver to its CoolClient backdoor. CoolClient itself is a secondary payload the group drops after an initial PlugX infection, and it already supported keylogging, clipboard theft, credential harvesting, file management, and plugin-based delivery of additional functionality on demand. The new driver, named msagent.sys, changes the calculus for defenders because it operates below the layer most endpoint detection tools inspect by default, turning a well-understood backdoor family into something considerably harder to spot once it lands on a target machine and settles in for long-term access.
Kaspersky's own assessment is blunt: "This sample introduces a previously undocumented kernel-mode driver that significantly expands the malware's stealth capabilities." That represents a meaningful jump in tradecraft rather than an incremental update. A kernel driver that hides its own footprint changes what your SOC can actually see, and it means alerts that depend on process enumeration or file-system scanning at the user-mode level will simply never fire for an infected host. Every downstream detection rule built on the assumption that the operating system reports the truth about what is running becomes unreliable the moment a driver like this loads successfully.
How the driver actually hides the intrusion
The driver receives its configuration through IOCTL requests sent from CoolClient's user-mode component. Those requests register trusted processes that should be left alone, pass along the IPv4 addresses used for command-and-control, and register filesystem and registry paths that need protecting from inspection. Once configured, the driver unlinks malicious processes from the Windows active process list, a classic direct kernel object manipulation technique that defeats tools relying on the OS's own process table.
It goes further than process hiding. Filesystem minifilters deny access attempts to the protected files, and the driver filters the C2 IP addresses out of any network information the OS reports back to user-mode tools. That means a network monitoring agent running on the same box as the malware can be fed a sanitized view of its own connections. Layered stealth like this only works because the driver has kernel privileges, which is exactly why the signed loading question matters so much.
Why an expired 2013 signature still works
The driver carries a digital signature from Nanjing Ranyi Technology Co., Ltd., valid only for the 2013 to 2014 window. On a fully current, well-configured Windows 10 or 11 system with strict driver signature enforcement, an expired certificate from over a decade ago should not be sufficient to load a kernel driver. That it apparently still functions on some targeted systems points to gaps in driver signature enforcement policy, legacy compatibility settings left in place for older line-of-business software, or targets running older builds that trust historical signing chains more permissively than a modern default install would allow.
This is a recurring pattern across nation-state tooling: reuse or repurpose an old, legitimately issued certificate rather than risk detection by using a stolen, actively-monitored one that vendors and researchers are already watching closely. For CTOs, the practical takeaway is that driver allowlisting and Microsoft's vulnerable and blocklisted driver list need to be current and enforced fleet-wide, on every endpoint, rather than relied upon as a default OS setting that nobody revisits after imaging a machine and shipping it to a user years ago.
The targeting pattern tells you who should care most
Kaspersky confirmed targets are government entities and officials in Myanmar, Mongolia, Pakistan, and Russia. That geographic spread is consistent with Mustang Panda's long-running mission profile: intelligence collection against governments across South and Southeast Asia, alongside intelligence collection against Russian government targets as well, a detail that suggests the group's tasking runs on its own priorities and is not purely aligned with any single geopolitical bloc or alliance structure most observers would expect.
Enterprises headquartered or operating regional offices in any of those four countries, particularly those in critical infrastructure, telecom, or government contracting, sit squarely in the blast radius even when they are not the primary target of the campaign. PlugX and its downstream payloads have a long history of lateral movement into partner and vendor networks once an initial government or ministry foothold is established, so third-party risk teams doing business anywhere in this region should treat this campaign as an active, live threat deserving immediate attention rather than background threat-intel noise to file away.
What this means for endpoint detection strategy
Most commercial EDR platforms build their detection logic on top of user-mode telemetry: process creation events, file writes, registry changes, and network connections, all as reported by the operating system itself. A kernel driver purpose-built to falsify exactly that telemetry represents a direct attack on the trust model most security operations centers are built around, and CoolClient's new driver was specifically engineered to defeat the categories of detection enterprise security teams rely on the most heavily for their day-to-day alerting and triage decisions.
The mitigation path runs through kernel-level visibility: hypervisor-based or driver-level EDR sensors that do not depend solely on what the OS reports back, combined with strict, continuously updated enforcement of Microsoft's driver blocklist and signature policy across the entire fleet. CISOs should also ask their EDR vendor a direct question this week: does our sensor detect DKOM-style process unlinking, and does it validate driver certificates against revocation and expiry independently of whatever Windows itself reports at driver load time, since this campaign shows that self-reporting layer can no longer be trusted at face value.
