Islamabad (GNP): Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered an updated version of the CoolClient backdoor — malware that grants attackers remote access — being used in intrusions against organizations and government bodies in Myanmar, Mongolia, Pakistan, India, and Russia.
Researchers have tied this new CoolClient variant to the HoneyMyte threat group, also known as Mustang Panda, as part of a 2026 espionage campaign spanning Asia and Russia.
The malware relies on a signed kernel-level driver — software operating deep within the operating system — to conceal itself on compromised Windows machines. In the campaign Kaspersky observed, the attackers first used PlugX, another commonly deployed backdoor, to install the CoolClient components after gaining initial access.
This latest CoolClient version is built for stealth, making it harder to detect and remove. It installs a signed driver that operates at a deep system level, helping hide the malware’s presence while shielding related files and registry entries from being inspected or altered, and supporting the backdoor’s ongoing operations on infected machines.
Before deploying the malware, the attackers configured Microsoft Defender to exclude a specific folder and file from scanning — targeting a fake Windows Defender directory and a renamed executable called defender.exe. They then created this fake directory, moved the CoolClient files into it, and renamed a legitimate Sangfor application to defender.exe so it could be used to run malicious code.
To ensure the malware survived a system restart, the attackers set up a scheduled task that automatically launched defender.exe at startup with the highest level of local Windows privileges. Once running, this loaded a malicious file called libngs.dll, kicking off the CoolClient infection process.
Kaspersky GReAT security researcher Fareed Radzi explained that this CoolClient variant marks a notable step forward for the malware. Rather than functioning purely as a plugin-supported, user-mode backdoor as before, it now installs and communicates with a kernel-mode driver that significantly expands its capabilities.
This driver lets CoolClient conceal and protect processes, files, and registry entries, as well as filter certain network traffic — making the malware much harder to detect and analyze. For affected organizations, this means the malware can persist on compromised systems while hiding evidence of its presence and hampering efforts by security teams to investigate or remove it.
To defend against this new CoolClient variant, Kaspersky GReAT advises organizations to stay alert for the HoneyMyte indicators of compromise and other tools detailed in the report. The firm recommends deploying comprehensive security solutions from its Kaspersky Next product line, which combine real-time protection with threat visibility, investigation, and response capabilities across EPP, EDR, and XDR.
Kaspersky also suggests that security teams equip themselves with detailed threat intelligence to better understand risks targeting their organization throughout the incident management process, enabling faster identification of potential threats.
For organizations lacking in-house cybersecurity expertise, Kaspersky recommends its managed security services — including Compromise Assessment, Managed Detection and Response, and Incident Response — which support organizations through the full incident lifecycle, from initial threat detection to ongoing protection and remediation.
Sohail Majeed is a Special Correspondent at The Diplomatic Insight. He has twelve plus years of experience in journalism & reporting. He covers International Affairs, Diplomacy, UN, Sports, Climate Change, Economy, Technology, and Health.
