Kaspersky Warns of Upgraded CoolClient Malware
- Kaspersky detects upgraded CoolClient malware linked to Honeymite in Asia and Russia
- The malware utilizes a signed kernel driver to hide files and evade detection
- Attackers use spoofed Microsoft Defender directories and scheduled tasks for persistence
Global cybersecurity firm Kaspersky’s GReAT team has detected an upgraded version of the CoolClient malware linked to the Honeymite (Mustang Panda) espionage group targeting Asia and Russia. The advanced strain leverages a signed kernel driver to evade security tools, conceal malicious files and registry entries, and hinder post-infection remediation efforts.
The technical execution begins with attackers modifying Microsoft Defender exclusions to create a fake Defender directory. They rename a legitimate Sangfor executable to "defender.exe" and configure a scheduled task with elevated privileges for boot persistence. Executing "defender.exe" loads the malicious "libngs.dll" file, which ultimately initiates the CoolClient payload.
Kaspersky GReAT Security Researcher Farid Radji noted that the latest iteration marks a structural evolution from legacy user-mode backdoors to direct kernel-mode driver communication. This allows the malware to mask processes, protect registry objects, and filter network packets, making analysis exceptionally difficult for security teams.
Kaspersky advises organizations to monitor Honeymite threat indicators, deploy Kaspersky Next protection, and utilize Managed Detection and Response (MDR) services to neutralize the threat.
//DBTech/RIP/SME/MIS//
