Microsoft Windows: Mustang Panda Leverages Legacy Certificate Trust for Kernel Rootkit Deployment
The threat actor Mustang Panda (HoneyMyte) has upgraded its CoolClient backdoor with a kernel-mode rootkit that exploits a legacy certificate trust vulnerability in the Microsoft Windows kernel. By leveraging a digital signature that expired in September 2014, the actor bypasses modern driver signature enforcement via cross-signed certificate mechanisms. This allows the loading of malicious drivers to achieve ring-0 execution, enabling deep persistence and stealth. The rootkit provides advanced evasion capabilities, including the masking of processes, files, registry objects, and C2 network traffic, effectively blinding EDR tools. This exploit demonstrates a critical failure in legacy certificate validation within modern operating environments.
PoisonX Rootkit: BYOVD Exploitation and CrowdStrike EDR Bypass
The PoisonX rootkit utilizes a Bring Your Own Vulnerable Driver (BYOVD) attack vector to achieve kernel-mode execution, specifically facilitating a 0-day bypass of CrowdStrike EDR. By deploying legitimate but vulnerable drivers, the threat actor escalates privileges from user-mode to kernel-mode, enabling the manipulation of OS structures to blind endpoint detection capabilities. Currently, the campaign is highly targeted toward organizations within Japan. Successful mitigation requires identifying the loading of known vulnerable drivers and implementing kernel-level monitoring to detect unauthorized driver manipulation and EDR neutralization attempts.