Mustang Panda Hackers Enhance CoolClient Backdoor with New Infostealer Capabilities

The Mustang Panda hacking group, known for its espionage activities, has released a new variant of its CoolClient backdoor. This updated malware can steal login credentials from browsers and monitor clipboard contents, posing a serious threat to users and organizations. Kaspersky researchers have linked CoolClient to attacks targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan, with deployment facilitated through legitimate software from Sangfor, a Chinese cybersecurity firm.

Since its association with Mustang Panda in 2022, CoolClient has been used alongside other backdoors like PlugX and LuminousMoth. The malware’s recent enhancements include a clipboard monitoring module, active window title tracking, and HTTP proxy credential sniffing, which utilizes raw packet inspection to evade detection. These capabilities significantly increase the risk of data theft and unauthorized access.

CoolClient’s execution flow involves gathering detailed information about the compromised system, including operating system version, RAM, and network details. The malware achieves persistence through Registry modifications and scheduled tasks, and supports privilege escalation and UAC bypassing, making it a formidable threat.

The updated malware version also features a plugin ecosystem that includes a remote shell plugin, service management plugin, and a more capable file management plugin. This allows operators to perform extensive operations on compromised systems, such as managing Windows services and executing files remotely.

Mustang Panda’s continued evolution of its toolset highlights the ongoing risks posed by state-sponsored hacking groups. The recent deployment of infostealers targeting Chrome, Edge, and other Chromium-based browsers is particularly concerning, as it leverages hardcoded API tokens for legitimate services like Google Drive to avoid detection.

Implications for Users and Organizations

The activities of Mustang Panda underline the importance of robust cybersecurity measures for both individuals and organizations. Users should be vigilant about the software they install and the permissions they grant, especially when dealing with applications from less familiar vendors.

Organizations, particularly those in sensitive sectors, should enhance their monitoring and detection capabilities to identify unusual activities that may indicate a breach. Regularly updating software and employing strong authentication methods can help mitigate the risks associated with such sophisticated malware.

As cyber threats continue to evolve, staying informed about the latest tactics used by threat actors like Mustang Panda is crucial for maintaining security and protecting sensitive data.