threatlabsnews.xcitium.com • 2h
Microsoft Windows: Mustang Panda Exploits Legacy Certificate Trust to Deploy Kernel Rootkits
Mustang Panda (HoneyMyte) has upgraded its CoolClient backdoor by integrating a kernel-mode rootkit signed with a digital certificate that expired in September 2014. This attack leverages a systemic flaw in Windows' driver signature enforcement, specifically the continued trust for legacy cross-signed drivers. By executing at the kernel level, the rootkit achieves high-privilege persistence and total invisibility by manipulating kernel objects to hide malicious processes, registry keys, and Command and Control (C2) network traffic. This effectively bypasses standard Endpoint Detection and Response (EDR) telemetry, posing a significant threat to Windows environments that have not transitioned away from legacy trust mechanisms.