Mustang Panda Deploys Signed Windows Rootkit with Updated CoolClient Backdoor

According to Russian cybersecurity vendor Kaspersky, the threat actor tracked as Mustang Panda -- also known as HoneyMyte -- has been observed deploying an updated version of the CoolClient backdoor. This new iteration incorporates a signed Windows kernel-mode rootkit designed to provide stealthy persistence and concealment of malicious activity.

The rootkit functionality allows the malware to hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. By leveraging a signed kernel-mode driver, the threat actor aims to bypass security controls and maintain persistence on compromised systems.

Kaspersky identified victims in Myanmar, Mongolia, and Pakistan. The exact infection chains and distribution methods used in these campaigns are not fully detailed in the available reports, but the deployment of a signed rootkit represents a significant escalation in the group's stealth capabilities.

The CoolClient backdoor has been associated with Mustang Panda's espionage activities. The addition of a kernel-mode rootkit enhances the threat actor's ability to evade detection and maintain access to compromised environments.