Government Entities Coolclient Infostealer

Mustang Panda Targets Asian Governments with Upgraded CoolClient

TechOwl TechOwl January 29, 2026
Mustang Panda Targets Asian Governments with Upgraded CoolClient

Mustang Panda Deploys Updated CoolClient Backdoor with Infostealer Capabilities

Executive Summary

In January 2026, security researchers identified an updated variant of the CoolClient backdoor deployed by the threat actor tracked as Mustang Panda (also known as HoneyMyte and Bronze President). This campaign targets government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan with new capabilities including clipboard monitoring, browser credential theft, and cloud service abuse for command-and-control.

Key Findings

  • New clipboard monitoring via GetClipboardData and GetWindowTextW Windows APIs
  • Three browser credential stealer variants targeting Chrome, Edge, and Chromium browsers
  • HTTP proxy credential sniffing through raw packet inspection
  • Cloud C2/exfiltration using hardcoded Google Drive and Pixeldrain API tokens
  • DLL side-loading via legitimate signed software

Threat Actor Profile

This threat actor is tracked under multiple aliases across the security industry:

  • Mustang Panda
  • HoneyMyte
  • Bronze President
  • Earth Preta
  • RedDelta
  • TA416

Mustang Panda is an espionage-focused threat actor known for targeting government entities. The group has been observed deploying tools including PlugX, ToneShell, and CoolClient.

Targets

The January 2026 campaign targets government entities in:

  • Myanmar
  • Mongolia
  • Malaysia
  • Russia
  • Pakistan

Delivery Method

CoolClient is delivered via DLL side-loading, abusing legitimate signed software. Previous campaigns have abused binaries from various software vendors including security products and media players.

Technical Analysis

Infection Chain

Stage Action Technical Detail MITRE ATT&CK
Initial Access Spearphishing email Malicious archive delivered as email attachment targeting government personnel T1566.001 - Spearphishing Attachment
User Execution Victim opens archive Archive contains legitimate signed executable (Sang.exe) bundled with malicious DLL T1204.002 - Malicious File
Execution DLL Side-Loading Sang.exe loads libngs.dll (malicious loader) due to DLL search order hijacking T1574.002 - DLL Side-Loading
Defense Evasion Payload decryption libngs.dll decrypts and loads:
- loader.dat (shellcode loader)
- main.dat (CoolClient core)
- time.dat (C2 configuration)		 T1140 - Deobfuscate/Decode Files
Persistence Multiple mechanisms - Registry Run key modification
- Scheduled Task: ComboxResetTask
- Windows Service: media_updaten		 T1547.001 - Registry Run Keys
T1053.005 - Scheduled Task
Command & Control C2 communication established Custom protocol over TCP port 443
Fallback: UDP protocol
Cloud backup: Google Drive, Pixeldrain APIs		 T1095 - Non-Application Layer Protocol
T1102 - Web Service
 Collection Data harvesting begins - Keylogging (window context tracking)
- Clipboard monitoring
- Browser credential theft
- System profiling		 T1056.001 - Keylogging
T1115 - Clipboard Data
T1555.003 - Browser Credentials
 Expansion Plugin deployment In-memory plugin execution:
- ServiceMgrS.dll (service control)
- FileMgrS.dll (file operations)
- RemoteShellS.dll (remote access)		 T1129 - Shared Modules
Exfiltration Data extraction Stolen data sent via:
- Direct C2 channel
- FTP server (113.23.212[.]15)
- Cloud storage APIs		 T1041 - Exfil Over C2
T1567.002 - Exfil to Cloud


Overview of CoolClient execution flow

CoolClient Capabilities

Capability Description
System Profiling Collects hostname, OS version, RAM, MAC/IP addresses, logged-in user, driver information
Keylogging Records keystrokes with window context
File Operations Upload, download, delete files
TCP Tunneling Creates TCP tunnels to bypass network restrictions
Reverse Proxy Establishes reverse proxy connections
Plugin Execution Loads and executes in-memory modules

New Features (January 2026)

Feature Implementation
Clipboard Monitoring Uses GetClipboardData and GetWindowTextW Windows APIs
HTTP Proxy Credential Theft Raw packet inspection and header extraction
Browser Credential Stealers Three variants targeting Chrome, Edge, and Chromium browsers
Cloud C2/Exfiltration Hardcoded API tokens for Google Drive and Pixeldrain

Clipboard Stealing Mechanism

The clipboard monitoring feature captures:

  • Clipboard contents (passwords, sensitive data)
  • Active window title (context)
  • Process ID
  • Timestamp

Captured data is obfuscated using single-byte XOR (key: 0xAC) and written to:

C:\ProgramData\AppxProvisioning.xml

Browser Credential Stealers

Variant Target MD5 Hash
A Google Chrome 1A5A9C013CE1B65ABC75D809A25D36A7
B Microsoft Edge E1B7EF0F3AC0A0A64F86E220F362B149
C Chromium-based DA6F89F15094FD3F74BA186954BE6B05

Target paths:

Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
Edge:   %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data

DLL Side-Loading Technique

DLL side-loading exploits the Windows DLL search order mechanism. When a legitimate application loads, Windows searches for required DLLs in a specific order. Attackers place a malicious DLL with the same name as an expected DLL in a location that gets searched first.

How It Works

Step Description
1 Attacker identifies a legitimate signed executable that loads a specific DLL
2 Attacker creates a malicious DLL with the same name (e.g., libngs.dll)
3 Both files are placed in the same directory and delivered to victim
4 Victim executes the legitimate binary (Sang.exe)
5 Windows loads the malicious DLL from the application directory first
6 Malicious code executes within the process context of the signed application

Windows DLL Search Order

1. Directory containing the executable (EXPLOITED)
2. System directory (C:\Windows\System32)
3. 16-bit system directory (C:\Windows\System)
4. Windows directory (C:\Windows)
5. Current working directory
6. Directories listed in PATH environment variable

The malware exploits position #1 in the search order by placing the malicious DLL alongside the legitimate executable.


Function that copies Chrome browser login data into a temporary file (chromeTmp) for exfiltration

Why This Technique Is Effective

  • Trusted Process: Malicious code executes within the context of a signed, legitimate process
  • Bypasses Application Whitelisting: The executable itself is trusted
  • Evades Detection: Security tools may not inspect DLLs loaded by trusted apps
  • No Exploitation Required: Uses normal Windows behavior, not a vulnerability

Plugins

Plugin MD5 Hash Function
ServiceMgrS.dll 7AA53BA3E3F8B0453FFCFBA06347AB34 Enumerate, create, start, stop, delete Windows services
FileMgrS.dll A1CD59F769E9E5F6A040429847CA6EAE Drive enumeration, ZIP compression, network mapping
RemoteShellS.dll 1BC5329969E6BF8EF2E9E49AAB003F0B Hidden cmd.exe remote shell

Command & Control Infrastructure

Domains

account.hamsterxnxx[.]com
popnike-share[.]com
japan.Lenovoappstore[.]com

IP Addresses

113.23.212[.]15   - FTP exfiltration server
45.144.165[.]65   - Malware distribution

Protocol

CoolClient uses TCP as the default C2 protocol (port 443), with UDP as an alternative option.

Cloud Service Abuse

This campaign abuses legitimate cloud services for C2 and exfiltration using hardcoded API tokens:

  • Google Drive
  • Pixeldrain

Indicators of Compromise

File Hashes (MD5)

CoolClient Core

F518D8E5FE70D9090F6280C68A95998F  libngs.dll
1A61564841BBBB8E7774CBBEB3C68D5D  loader.dat
AEB25C9A286EE4C25CA55B72A42EFA2C  main.dat
6B7300A8B3F4AAC40EEECFD7BC47EE7C  time.dat

Plugins

7AA53BA3E3F8B0453FFCFBA06347AB34  ServiceMgrS.dll
A1CD59F769E9E5F6A040429847CA6EAE  FileMgrS.dll
1BC5329969E6BF8EF2E9E49AAB003F0B  RemoteShellS.dll

Browser Stealers

1A5A9C013CE1B65ABC75D809A25D36A7  Chrome Stealer
E1B7EF0F3AC0A0A64F86E220F362B149  Edge Stealer
DA6F89F15094FD3F74BA186954BE6B05  Chromium Stealer

Scripts

C19BD9E6F649DF1DF385DEEF94E0E8C4  1.bat
838B591722512368F81298C313E37412  Ttraazcs32.ps1
A4D7147F0B1CA737BFC133349841AABA  t.ps1

Network Indicators

account.hamsterxnxx[.]com
popnike-share[.]com
japan.Lenovoappstore[.]com
113.23.212[.]15
45.144.165[.]65

File System Artifacts

C:\ProgramData\AppxProvisioning.xml

Persistence Indicators

Scheduled Task: ComboxResetTask
Service Name: media_updaten

MITRE ATT&CK Mapping

Tactic Technique ID Technique Name Evidence
Defense Evasion T1574.002 DLL Side-Loading Sang.exe + libngs.dll
Persistence T1547.001 Registry Run Keys Registry persistence
Persistence T1053.005 Scheduled Task ComboxResetTask
Defense Evasion T1140 Deobfuscate/Decode XOR obfuscation (key: 0xAC)
Credential Access T1555.003 Credentials from Web Browsers 3 browser stealer variants
Credential Access T1056.001 Keylogging CoolClient keylogger
Collection T1115 Clipboard Data GetClipboardData API abuse
Command & Control T1095 Non-Application Layer Protocol Direct TCP/UDP C2 communication
Command & Control T1102 Web Service Google Drive, Pixeldrain abuse
Exfiltration T1567.002 Exfiltration to Cloud Storage Hardcoded API tokens

Detection Opportunities

Endpoint Detection

API Monitoring:

User32.dll!OpenClipboard
User32.dll!GetClipboardData
User32.dll!CloseClipboard
User32.dll!GetWindowTextW

File System:

  • Monitor creation of C:\ProgramData\AppxProvisioning.xml
  • Watch for access to browser Login Data files from non-browser processes

Process Behavior:

  • Sang.exe executing from unusual locations
  • Processes loading libngs.dll from non-standard paths

Network Detection

  • DNS queries to listed C2 domains
  • Unusual traffic to Google Drive or Pixeldrain APIs
  • FTP connections to 113.23.212[.]15

Conclusion

HoneyMyte remains a persistent threat, actively deploying an evolved arsenal featuring the enhanced CoolClient backdoor, browser credential stealers, and document exfiltration scripts.

Beyond basic espionage like file theft and persistence, these tools enable advanced user surveillance through keylogging, clipboard capture, proxy credential sniffing, browser data harvesting, and bulk file operations—signaling a clear pivot to real-time activity monitoring.

 Organizations must heighten defenses against HoneyMyte's toolkit, including CoolClient and affiliates like PlugX, ToneShell, Qreverse, and LuminousMoth, as part of a broader strategy for long-term system access and intelligence gathering.

Related Posts