A Familiar Chinese Backdoor Learns New Tricks — And Widens Its Aim to Include Russia- 342

August 22, 2026

Kaspersky's Global Research and Analysis Team has documented a 2026 upgrade to CoolClient, a backdoor long associated with the Chinese state-linked espionage group HoneyMyte — better known by its more common designation, Mustang Panda — and the update matters less for its individual technical refinements than for where it has been deployed: a campaign spanning Myanmar, Mongolia, Pakistan, India, and, notably, Russia, a country whose inclusion in a Chinese-attributed espionage campaign sits awkwardly against the public narrative of Sino-Russian strategic alignment.

Technically, the new CoolClient variant marks a meaningful evolution from earlier versions of the malware. Where previous iterations functioned as a user-mode backdoor extended through plugins, the updated build now deploys and communicates with a signed kernel-mode driver — software running deep enough in the Windows operating system to hide the malware's presence, shield its associated files and registry entries from inspection or modification, and filter selected network traffic to frustrate analysis. According to Kaspersky researcher Fareed Radzi, this shift extends the backdoor's capabilities well beyond what earlier, purely user-mode versions could achieve, giving the malware a materially harder profile to detect, investigate, or remove once entrenched on a compromised system.

The intrusion chain observed by Kaspersky shows a deliberate, methodical approach to establishing persistence while evading Windows' native defenses. Attackers first used PlugX — a backdoor already well established in the group's toolkit and typically deployed after an initial breach — to deliver the CoolClient components onto compromised machines. Before installing the malware itself, the actor configured Microsoft Defender to exclude a specific folder and file from scanning: a fake Windows Defender directory and a renamed executable called defender.exe. The attackers then created that fake directory, copied the CoolClient files into it, and renamed a legitimate Sangfor security program to defender.exe, repurposing trusted software as a vehicle for loading malicious code. To survive a reboot, they created a scheduled task that launched defender.exe automatically at startup with the highest local Windows privileges available, which in turn loaded a malicious library file, libngs.dll, to trigger the full CoolClient infection chain. The combination — a signed kernel driver for concealment, a disguised persistence mechanism masquerading as legitimate security software, and a delivery chain built on an already-established backdoor — reflects an actor investing specifically in staying power and detection evasion rather than in novel initial-access methods.

Mustang Panda's targeting pattern has long tracked Beijing's regional intelligence priorities across South and Southeast Asia, and the presence of Myanmar, Mongolia, Pakistan and India in this campaign is consistent with that history. Russia's inclusion is the detail that stands out. Despite the deepening public alignment between Moscow and Beijing since the invasion of Ukraine, Chinese state-linked actors have periodically been reported targeting Russian government and organizational networks — a pattern that suggests Beijing's intelligence services continue to pursue their own independent collection requirements against Moscow even where the two governments present a unified diplomatic front. Kaspersky has not detailed which Russian entities were targeted or to what end, but the campaign is a reminder that strategic partnership between states does not extend to intelligence services standing down against one another.