Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks

Mustang Panda Deploys Updated COOLCLIENT Backdoor

Mustang Panda, a China-linked threat actor, has been observed using an updated version of the COOLCLIENT backdoor in cyber espionage attacks to facilitate comprehensive data theft from infected endpoints, with the intrusions primarily directed against government entities across Asia and Russia. The updated malware was deployed as a secondary backdoor along with PlugX and LuminousMoth infections, allowing for extensive data collection and exfiltration.

Why This Matters

The use of COOLCLIENT and other malware by Mustang Panda highlights the technical reality of sophisticated cyber attacks, which often involve the use of multiple malware variants and exploitation of legitimate software vulnerabilities. This is in contrast to ideal models of cybersecurity, which often focus on preventing single-point failures. The failure scale of such attacks can be significant, with potential costs including loss of sensitive data, intellectual property, and national security.

Key Insights

COOLCLIENT was first documented by Sophos in November 2022, highlighting its use by China-based APT groups.
The malware has been used to target multiple telecom operators in a single Asian country, as revealed by Broadcom’s Symantec and Carbon Black Threat Hunter Team in June 2024.
Mustang Panda has also been observed deploying three different stealer programs to extract saved login credentials from Google Chrome, Microsoft Edge, and other Chromium-based browsers.

Working Example

// Example of COOLCLIENT's plugin architecture
// Service management plugin to oversee all services on the victim host
ServiceMgrS.dll {
    // Enumerate services
    EnumServices();
    // Create service
    CreateService();
    // Start service
    StartService();
}

// File management plugin to enumerate, create, move, read, compress, search, or delete files and folders
FileMgrS.dll {
    // Enumerate files
    EnumFiles();
    // Create file
    CreateFile();
    // Read file
    ReadFile();
}

// Remote shell plugin that spawns a "cmd.exe" process to allow the operator to issue commands and capture the resulting output
RemoteShellS.dll {
    // Spawn cmd.exe process
    SpawnProcess();
    // Issue command
    IssueCommand();
    // Capture output
    CaptureOutput();
}

Practical Applications

Use Case: Government agencies and telecom operators can use this information to enhance their cybersecurity measures, including implementing robust endpoint security solutions and conducting regular security audits to detect and prevent COOLCLIENT and other malware infections.
Pitfall: Organizations may underestimate the sophistication and capabilities of threat actors like Mustang Panda, leading to inadequate cybersecurity measures and increased vulnerability to attacks.

References:

On This Page