Security researchers have documented a fresh campaign by the China-linked threat cluster tracked as HoneyMyte, which is using a digitally signed kernel-mode rootkit to conceal a custom backdoor called CoolClient on compromised government networks. The operation, detailed by analysts at Kaspersky’s Securelist team based on activity observed across late 2025 and into 2026, shows the group leaning on a familiar playbook — PlugX for initial access — before pivoting to a far stealthier, kernel-level toolset for long-term persistence.

From PlugX Foothold to Kernel-Level Concealment

According to the research, the intrusion chain begins only after PlugX has already established a presence on the target machine. From there, the attackers create a folder disguised as part of Windows Defender and add exclusion rules covering both that folder and a renamed executable. A legitimate application from security vendor Sangfor is then renamed to impersonate “defender.exe” and used to sideload a malicious first-stage DLL, libngs.dll, along with a companion component, ctxmui.dll.

To survive reboots, the malware installs itself through multiple redundant mechanisms: a scheduled task that relaunches the renamed binary with SYSTEM-level privileges, a Windows AutoRun entry, and a dedicated service named “media_updaten.” The final-stage payload injects itself into the legitimate synchost.exe process, blending its activity with normal system operations.

A Rootkit Built to Blind Defenders

The centerpiece of the campaign is a kernel driver, msagent.sys, which researchers describe as digitally signed — though with an expired certificate issued to an entity called Nanjing Ranyi Technology Co., Ltd. Once loaded, the driver gives HoneyMyte capabilities that sit well below the reach of most endpoint tools:

• Unlinking the malicious process from Windows’ active-process listings, effectively hiding it from process viewers and monitoring agents
• Blocking attempts to terminate, inspect, or inject code into the hidden process
• Hooking the Nsiproxy network driver to strip the backdoor’s command-and-control IP addresses out of network telemetry
• Filtering file-system requests to deny access to the malware’s protected directories
• Intercepting registry enumeration calls to hide the keys associated with the implant

Because these techniques operate in kernel mode, security products that rely solely on user-mode visibility — a common limitation even among modern EDR agents — can miss the infection entirely unless they collect telemetry from a lower level of the operating system.

Targeting Government Networks Across Asia and Eastern Europe

Researchers link the CoolClient campaign to intrusions against government organizations in Pakistan, Mongolia, Myanmar, and Russia, consistent with HoneyMyte’s historical focus on state and diplomatic targets in the region. The group’s use of a signed — if improperly certified — driver suggests continued investment in techniques designed to slip past code-signing checks and driver-blocklisting defenses that many organizations rely on as a baseline control.

Indicators and Detection Guidance

The published research includes a set of command-and-control domains observed in the campaign, among them cloudtroe.giize[.]com, employers.theworkpc[.]com, freeread.casacam[.]net, us.lenovoappstore[.]com, and several dynamic-DNS style hostnames, alongside file hashes for the identified components. Suspicious installation paths flagged in the report include folders disguised as Windows Defender, Windows Media Player resources, and Symantec directories, as well as hidden application-data folders masquerading as Viber-related files.

For defenders, the researchers recommend treating the following as high-priority signals:

• Unexpected kernel driver services, particularly those tied to unfamiliar or recently expired certificates
• Defender exclusion rules that don’t match documented security policy, especially exclusions covering renamed executables
• Scheduled tasks or AutoRun entries launching “defender.exe” or similarly named binaries from non-standard locations
• Mismatches between a DLL’s expected publisher and the application that loads it

Perhaps the most important takeaway from the report is architectural: organizations that depend exclusively on user-mode process and network monitoring have a structural blind spot that kernel rootkits like this one are specifically engineered to exploit. Building in kernel-level telemetry — rather than trusting what the operating system’s own APIs report — is, in the researchers’ assessment, the only reliable way to catch this class of implant before it becomes deeply entrenched.