Chinese Hacking Group Hides Backdoor Behind a Signed Windows Rootkit

Key points

• Kaspersky researchers linked a new campaign to Mustang Panda, also tracked as HoneyMyte, a hacking group widely attributed to Chinese state interests.
• The attackers deployed an updated version of the CoolClient backdoor, a remote-control tool that lets them run commands on infected machines.
• The backdoor is paired with a signed Windows kernel-mode rootkit that hides files, processes, registry entries and network traffic from defenders.
• Confirmed victims sit in Myanmar, Mongolia and Pakistan, according to Kaspersky's telemetry.
• Because the rootkit carries a valid digital signature, Windows loads it without warning, blunting many standard detection tools.

A hacking group that Western researchers have followed for years under the names Mustang Panda and HoneyMyte has quietly upgraded its toolkit. According to Kaspersky, the group is now installing a fresh version of a backdoor called CoolClient alongside a rootkit that burrows into the deepest layer of Windows.

The Hacker News first reported the finding.

The short version: once the malware lands on a computer, the attackers can watch, steal and control at will, and the machine's own security software struggles to see any of it.

What did the attackers actually install?

They installed two things that work together. CoolClient is a backdoor, meaning a program that gives the attackers remote control of the machine. The second piece is a rootkit, a stealth tool that sits inside the Windows kernel, the most trusted part of the operating system.

Once loaded, the rootkit can hide the backdoor's files so they do not show up in folder listings. It hides the running process so Task Manager will not display it. It hides registry entries the malware needs to survive a reboot. And it masks the network traffic the backdoor sends back to its operators, known in the trade as command-and-control or C2 traffic.

That combination is unusual. Kernel rootkits are difficult to write and easy to break. Most criminal crews avoid them. State-linked groups tend to be the ones with the patience.

Why does a signed driver matter?

Because Windows trusts it by default. Since 2015, 64-bit Windows has required kernel drivers to carry a valid digital signature from a recognised authority before the operating system will load them. That rule exists to keep malicious code out of the kernel.

When attackers get hold of a signed driver, whether by stealing a certificate, abusing a legitimate one, or slipping through Microsoft's own signing process, they walk straight past that gate. Antivirus tools that check signatures see a green tick and move on.

Who is being targeted?

Kaspersky says it found victims in Myanmar, Mongolia and Pakistan. Mustang Panda has a long history of espionage against government bodies, non-profits and telecom operators across South and Southeast Asia, and the geography here fits that pattern.

Ordinary consumers are not the target. The people at risk are staff inside ministries, embassies, aid organisations and companies that do business with governments in the region.

What should defenders look at?

Focus on the driver layer. Security teams can pull a list of every kernel driver loaded on their endpoints and check the signing certificate, the issue date and the file hash against known-good inventories. Anything signed by a certificate that has been revoked, or issued to an obscure company, deserves a second look.

Microsoft maintains a driver block list that Windows can enforce automatically. Turning it on closes off many of the abused drivers that crews like Mustang Panda favour.

Log outbound network traffic at the firewall, not just on the endpoint. A rootkit can lie to the machine it lives on. It cannot lie to the router.

Common questions

Am I personally at risk from this malware?

Probably not. This campaign targets government and policy organisations in a small number of Asian countries. Home users and most businesses outside that scope are not in the crosshairs.

Does antivirus catch signed rootkits?

Often no, at least not on signature alone. Modern endpoint tools that watch driver behaviour, rather than just checking signatures, have a better chance, which is why Microsoft's driver block list and behavioural detection matter here.