Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Mustang Panda, also known as HoneyMyte, has updated the CoolClient backdoor with a signed Windows kernel-mode rootkit. This rootkit can conceal and protect various malicious components, including processes, files, and network communications. The addition of the rootkit is intended to enhance the stealth capabilities of the backdoor. Kaspersky, a Russian cybersecurity vendor, has identified victims of this updated backdoor in several countries, including Myanmar, Mongolia, and Pakistan. The use of a signed rootkit suggests an attempt to make the malware more difficult to detect. Victims have been found in multiple Asian countries.