The Chinese-speaking APT group HoneyMyte has deployed an updated version of its CoolClient backdoor in espionage operations targeting government and private organizations across Russia, Myanmar, Mongolia, Pakistan, and India.
The new variant operates at the Windows kernel level using a signed driver, allowing it to hide processes, files, registry entries, and network activity while evading detection by security tools.
Attack Chain and Delivery
Attackers first abuse the known backdoor PlugX to add exclusions for Microsoft Defender, ensuring the malicious components are ignored by Windows built-in protection. They then create a fake Windows Defender directory and place the components of CoolClient inside it.
The legitimate Sangfor application is renamed to defender.exe and used to load the malicious libngs.dll. Persistence is achieved through a scheduled task that automatically executes defender.exe with maximum local privileges upon Windows startup, reactivating the CoolClient chain.
Researchers from Kaspersky GReAT observed that the kernel-mode driver enables the backdoor to conceal and protect its components more effectively than previous user-mode versions that relied on plugins.
The technique of masquerading as Microsoft Defender while disabling real protections adds an ironic layer of stealth to the operation.
