Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor

Kaspersky reports that Mustang Panda has evolved its CoolClient backdoor into a more capable variant that now includes clipboard monitoring, active window tracking, HTTP proxy credential sniffing, and dedicated browser infostealer plugins; operators have used it (and a newly observed rootkit) against government targets across Myanmar, Mongolia, Malaysia, Russia, and Pakistan, deploying via legitimate Sangfor software and previously abused signed binaries to achieve persistence, privilege escalation, and versatile remote-control operations.