FlagThis — Daily Cybersecurity Intelligence Briefing

The threat actor Mustang Panda (HoneyMyte) has upgraded its CoolClient backdoor with a kernel-mode rootkit that exploits a legacy certificate trust vulnerability in the Microsoft Windows kernel. By leveraging a digital signature that expired in September 2014, the actor bypasses modern driver signature enforcement via cross-signed certificate mechanisms. This allows the loading of malicious drivers to achieve ring-0 execution, enabling deep persistence and stealth. The rootkit provides advanced evasion capabilities, including the masking of processes, files, registry objects, and C2 network traffic, effectively blinding EDR tools. This exploit demonstrates a critical failure in legacy certificate validation within modern operating environments.

This intelligence report details a sophisticated, multi-stage attack chain targeting the Pterodactyl game-server management panel, transitioning from unauthenticated web exploitation to full kernel-level compromise. The research demonstrates how an attacker can chain disparate vulnerabilities across the application, operating system, and Linux kernel to achieve total host takeover.