Mustang Panda CoolClient Evasion Framework Forensics

3 Key Takeaways

1. Four-Stage Modular Loading: The 2026 CoolClient backdoor utilizes a multi-stage execution flow designed to bypass traditional, signature-based security systems.
2. Abuse of Trusted Executables: The threat group continues to exploit signed binaries from legitimate software vendors to execute side-loading operations undetected.
3. Advanced Surveillance Focus: The inclusion of dedicated plugins for active clipboard sniffing and window tracking marks a clear transition to highly targeted, real-time user monitoring.

Executive Summary

State-sponsored cyber espionage operations targeting ASEAN government institutions have evolved toward highly evasive, memory-only execution chains. A prime example of this trend is Mustang Panda, a persistent, China-aligned advanced persistent threat (APT) actor that has refined its operations in early 2026.

This technical analysis delivers a deep-dive forensic breakdown of Mustang Panda’s updated CoolClient backdoor framework, currently targeting ministries of foreign affairs, defense networks, and critical infrastructure operators across Southeast Asia.

Through detailed analysis of its 4-stage modular execution flow, DLL side-loading vectors, and dynamic API hooking techniques, this assessment provides defense teams with the actionable indicators and detection strategies required to hunt and neutralize this threat.

The CoolClient 4-Stage Execution Architecture

The 2026 iteration of the CoolClient backdoor is designed to minimize its disk footprint, utilizing a modular, multi-stage loading process to bypass traditional endpoint detection and response (EDR) platforms.

Stage 1: The Initial Loader (libngs.dll)

The compromise begins with DLL side-loading, utilizing a legitimate, digitally signed application (such as Sangfor’s Sang.exe or Bitdefender’s qutppy.exe) to execute the malicious initial loader (libngs.dll).

Once loaded into the process memory space of the trusted application, libngs.dll runs a basic anti-analysis check to detect if it is running within a sandbox or debugging environment. If no analysis tools are detected, it locates the encrypted file loader.dat within its local directory.

Stage 2: The Second-Stage Orchestrator (loader.dat)

libngs.dll reads loader.dat into memory and decrypts it using a customized XOR-based decryption routine. The decrypted shellcode serves as the orchestrator, conducting system reconnaissance (identifying active processes, operating system build numbers, and installed security agents).

Once complete, the shellcode targets a legitimate Windows system process, typically write.exe or winver.exe, and executes a process hollowing routine to inject its payload.

Stage 3: The Configuration Decryption (time.dat)

The injected shellcode reads and decrypts time.dat, which contains the encrypted C2 (Command and Control) server configuration details, fallback domain names, and beaconing intervals. To frustrate forensic recovery, time.dat is decrypted solely in volatile memory and is never written to disk in its raw state.

Stage 4: The Core Backdoor (main.dat)

With the configuration loaded, the backdoor executes its final stage payload (main.dat). This core module establishes a secure reverse proxy connection to the C2 server and initializes its modular surveillance plugin framework.

DLL Side-Loading and Hijacking Vectors

Mustang Panda continues to exploit trust relationships by abusing legitimate, signed executables from popular security and utility vendors. The table below catalogs the specific executable-to-DLL associations observed in recent ASEAN campaigns:

Privilege Escalation and Process Hollowing Mechanics

To bypass User Account Control (UAC) and gain system-level execution rights, CoolClient utilizes advanced Windows API abuse techniques.

CMSTPLUA UAC Bypass

If the compromised user account possesses local administrator privileges, the loader executes the CMSTPLUA COM interface bypass. By instantiating the COM object {3E5FC7F9-9A51-4367-9063-A120244FBEC7}, the malware executes elevated shell operations without triggering a UAC prompt on the victim’s desktop.

Process Hollowing Flow

Once privileges are elevated, the orchestrator targets C:WindowsSystem32write.exe:

1. Creation in Suspended State: It calls the CreateProcessW API with the CREATE_SUSPENDED flag.
2. Unmapping Remote Memory: The malware calls NtUnmapViewOfSection to hollow out the legitimate code section from the target process’s memory space.
3. Memory Allocation: It uses VirtualAllocEx to allocate new, executable memory space within the suspended target.
4. Payload Injection: It writes the core backdoor code into the newly allocated memory space using WriteProcessMemory.
5. Thread Context Modification: The malware updates the thread’s instruction pointer (EIP/RIP) to target the newly injected entry point using the SetThreadContext API.
6. Resuming Thread Execution: Finally, the malware calls ResumeThread to initiate execution of the malicious code disguised as a legitimate system process.

Advanced Surveillance Plugins and In-Memory Data Theft

The 2026 CoolClient backdoor has transitioned from simple file collection to highly targeted, real-time user surveillance. This capability is managed through three dedicated, dynamically loaded DLL plugins:

• FileMgrS.dll (File Management): Traverses the directory tree, targeting files with extensions like .docx, .xlsx, .pdf, and .key.
• ServiceMgrS.dll (Service Management): Monitors running system services, allowing attackers to disable local security agents and modify registry values.
• RemoteShellS.dll (Remote Shell): Provides the C2 operator with an interactive, encrypted command-line interface.

Clipboard and Session Monitoring APIs

The malware targets sensitive user data by continuously monitoring active windows and clipboard content using native Windows APIs:

1. Active Window Tracking: It utilizes GetWindowTextW to capture the title of the active window. This allows the malware to identify when a user is interacting with sensitive systems, such as database consoles or password managers.
2. Clipboard Sniffing: It opens the system clipboard using OpenClipboard and retrieves text data via GetClipboardData. This allows the backdoor to harvest complex passwords, cryptocurrency addresses, and MFA recovery codes directly from memory.

Technical Modeling of C2 Beaconing Entropy

To bypass network-level detection systems, CoolClient utilizes random jitter intervals between its beacon transmissions. To differentiate this traffic from normal web browsing patterns, security analysts can calculate the Shannon Entropy of the packet arrival intervals.

Normal, human-initiated web browsing traffic exhibits high entropy values due to irregular user activity and variable page load times. In contrast, CoolClient’s automated beaconing, even with random jitter added, maintains a highly patterned interval profile, resulting in a significantly lower entropy score. Defensive monitoring systems can flag network nodes showing these low-entropy communication profiles for further analysis.

Defensive Engineering & Hunting Guide

YARA Detection Rule

The following YARA rule is designed to identify the 2026 CoolClient backdoor core payload in memory or on-disk.

Code snippet rule APT_MustangPanda_CoolClient_2026 {
    meta:
        author = “CommandEleven Cyber Defense Unit”
        description = “Detects 2026 CoolClient main.dat payload and stage 1 loaders”
        date = “2026-07-14”
        reference = “C11-SEA-UPD-2026-07-14”
        severity = “Critical”

    strings:
        $loader_dll = “libngs.dll” ascii wide nocase
        $plugin_1 = “FileMgrS.dll” ascii wide
        $plugin_2 = “ServiceMgrS.dll” ascii wide
        $plugin_3 = “RemoteShellS.dll” ascii wide
        $uac_bypass = “CMSTPLUA” ascii wide

        /* Hex signature for custom XOR decryption routine */
        $decryption_loop = { 8A 0C 0B 32 0C 02 88 0C 0B 41 3B C8 72 F2 }

    condition:
        uint16(0) == 0x5A4D and
        (3 of ($loader_dll, $plugin_1, $plugin_2, $plugin_3) or ($uac_bypass and $decryption_loop))
}

Behavioral Signatures for SIEM/EDR Hunting

Security Operations Centers (SOCs) should deploy monitoring rules targeting the following behaviors:

• Atypical Process Spawning: Monitor instances where write.exe or winver.exe establishes external network connections, particularly on ports 80, 443, or 8080.
• Unusual Directory Operations: Flag the creation or execution of executable files or DLLs in public folders such as C:UsersPublic or C:ProgramData.
• Unexpected API Calls: Audit endpoint events for high frequencies of GetClipboardData and GetWindowTextW executed from non-browser, non-system processes.

Strategic Analytical Outlook (2026–2030)

CommandEleven Intelligence assesses Mustang Panda’s deployment of the CoolClient backdoor reflects a broader shift toward persistent, memory-only espionage across the ASEAN region. As local governments digitize their administrative workflows, they present high-value targets for state-sponsored actors.

Through 2030, the threat landscape will likely see deeper integration of machine-learning models to automate the discovery of vulnerable credentials, making traditional static defenses ineffective.

To secure networks, ASEAN defense organizations must shift toward zero-trust architectures, using behavioral monitoring and automated application control to intercept and neutralize these stealthy intrusion chains.

The Salt Typhoon Playbook: China’s Cyber Campaign Against Global Infrastructure

• ASEAN Cyber Espionage & Critical Infrastructure Penetration
• ASEAN Cyber Espionage Topologies & APT TTPs Analysis
• Mustang Panda: CoolClient Evasion Framework Forensics
• ORB Botnets & Edge Appliance Exploitation in ASEAN
• ASEAN Cyber Espionage Ecosystems & Sub-Sea Interception
• Global C2 Exploitation of Telecom Networks
• Chinese Cyber Attacks Against Western Critical Infrastructure
• Cyber-Kinetic Convergence & Industrialized Intrusion Vectors