The HoneyMyte APT group's CoolClient backdoor has been upgraded with a kernel-mode Windows rootkit, enhancing its stealth capabilities. The malware is deployed as a secondary backdoor after an initial PlugX infection and targets organizations across Asia and Russia. It supports features such as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. The new variant can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and hide the CoolClient process, protect related files and registry entries, and prevent them from being inspected or modified.
The malware follows a multi-stage execution chain, with each component performing a distinct role during execution. The first stage loader, a malicious library, decrypts and loads the next stage into memory, while the second-stage DLL, a malicious file, prepares the execution environment before the malware transitions into its injected process. The command handler remains largely unchanged from previous CoolClient variants, with one notable difference: the malware now injects into a malicious executable instead of a malicious executable. Persistence is established through a scheduled task that launches a malicious executable with SYSTEM privileges during system startup.[/subscribe_to_unlock_form]
The HoneyMyte APT group's CoolClient backdoor has been upgraded with a kernel-mode Windows rootkit, enhancing its stealth capabilities. The malware is deployed as a secondary backdoor after an initial PlugX infection and targets organizations across Asia and Russia. It supports features such as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. The new variant can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and hide the CoolClient process, protect related files and registry entries, and prevent them from being inspected or modified.
The malware follows a multi-stage execution chain, with each component performing a distinct role during execution. The first stage loader, a malicious library, decrypts and loads the next stage into memory, while the second-stage DLL, a malicious file, prepares the execution environment before the malware transitions into its injected process. The command handler remains largely unchanged from previous CoolClient variants, with one notable difference: the malware now injects into a malicious executable instead of a malicious executable. Persistence is established through a scheduled task that launches a malicious executable with SYSTEM privileges during system startup.[emaillocker id="1283"]
The user-mode component follows an execution path that includes persistence, UAC bypass, registry modifications, and process injection. The driver deployment routine begins by decrypting a malicious file, verifying that it has sufficient privileges to install a kernel-mode driver, extracting an embedded LZMA-compressed driver from a malicious file, decompressing it, and writing it to disk as a malicious file. Once the driver is loaded, CoolClient establishes communication with it through IOCTL requests, initializing the driver by issuing three DeviceIoControl requests.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Persistence | T1543.003 | Create or Modify System Process | Windows Service |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Defence Evasion | T1036.005 | Masquerading | Match Legitimate Resource Name or Location |
| Defence Evasion | T1070.004 | Indicator Removal | File Deletion |
| Defence Evasion | T1574.001 | Hijack Execution Flow | DLL |
| Collection | T1560.001 | Archive Collected Data | Archive via Utility |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and control | T1573.001 | Encrypted Channel | Symmetric Cryptography |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Defense Evasion | F0004 | Disable or Evade Security Tools |
| Command & Control | B0030 | C2 Communication |
| Impact | B0022 | Remote Access |
The following reports contain further technical details:
[/emaillocker]