HoneyMyte Enhances CoolClient with a Signed Windows Kernel R...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/honeymyte-coolclient-driver-rootkit/121028
• Blog Title: HoneyMyte Enhances CoolClient with a Signed Windows Kernel Rootkit
• Suggested Section: Windows Hardening → Windows Local Privilege Escalation / DLL Hijacking and Process Abuse; add a dedicated Windows Kernel Rootkits and DKOM subsection covering signed-driver IOCTL analysis, EPROCESS and PsLoadedModuleList unlinking, ObRegisterCallbacks protection, registry/filesystem callbacks, Nsiproxy filtering, and RPC debug-object UAC bypass

🎯 Content Summary

Overview and impact

CoolClient is a modular Windows backdoor attributed to HoneyMyte, also known as Mustang Panda. It supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, C2 communication, and plugin-based extensions. In intrusions observed during late 2025 and 2026, the malware added a signed kernel-mode driver, msagent.sys, that communicates with the user-mode implant through IOCTL requests and provides rootkit capabilitie...

🔧 Technical Details

Trusted executable DLL sideloading: Place a malicious DLL under a dependency name expected by a legitimate executable and run both from the same attacker-controlled directory. CoolClient uses a legitimate Sangfor application, optionally renamed to resemble a trusted security binary, to load libngs.dll. Dummy exports mimic the legitimate dependency while the malicious workflow executes from DllMain. Combining sideloading with a fake trusted-product directory and antivirus exclusions reduces scanning and makes execution appear legitimate.

Encrypted in-memory staging: Store later DLL stages in files with non-executable extensions, decrypt them only in memory, and manually transfer execution to the decrypted image. CoolClient uses a repeating 0x32-byte XOR keystream derived from seed 0xA4 for the first loading of loadcert.ini and a stream derived from base key 0x4D for t...

🤖 Agent Actions

Plan:

1. Inspect the Windows/kernel, injection, UAC, DLL sideloading, and driver-related documentation and compare at least five candidate pages.
2. Extract only novel, reusable techniques from the supplied research and choose one best existing page.
3. Edit that page with concise technical details and numbered citations, preserving existing content.
4. Review the diff, validate links/formatting, and run targeted repository checks.
   Repository review shows the sideloading and suspended-process patterns are already covered, while the kernel rootkit architecture (IOCTL trust boundary, DKOM unlinking, callback-based protection/cloaking, and Nsiproxy filtering) is not. I’ll therefore add one focused Windows kernel-rootkit page and only link it from the existing Windows driver section, avoiding duplication across DLL/UAC pages.
   The core content is now written. I’m validating the new page’s pathing, Markdown/citation format, and the UAC insertion, then I’ll run repository-level diff checks and correct any issues found.
   Implemented the HackTricks update.

Changes

• Added windows-kernel-rootkits-and-dkom.md covering:
  • Signed-driver and IOCTL analysis
  • Trusted-process exemptions
  • EPROCESS.ActiveProcessLinks DKOM
  • PsLoadedModuleList unlinking
  • Object, process, image, filesystem, and registry callbacks
  • Nsiproxy network filtering
  • Cross-layer detection methodology
• Added the RPC/debug-object UAC bypass to the existing UAC page.
• Linked the new page from the Windows driver section and SUMMARY.md.
• Added numbered references to the original Project Zero research and Securelist analysis.
• Avoided duplicating already-documented DLL sideloading and process-injection material.

Validation

• git diff --check: passed
• Internal paths and citation numbering: passed
• Forbidden-source check: passed
• mdbook build unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/honeymyte-coolclient-driver-rootkit/121028

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening → Windows Local Privilege Escalation / DLL Hijacking and Process Abuse; add a dedicated Windows Kernel Rootkits and DKOM subsection covering signed-driver IOCTL analysis, EPROCESS and PsLoadedModuleList unlinking, ObRegisterCallbacks protection, registry/filesystem callbacks, Nsiproxy filtering, and RPC debug-object UAC bypass".

Repository Maintenance:

• MD Files Formatting: 1030 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0