How Threat Actors Exploit Vulnerable Windows Drivers in BYOVD Attacks
Summary
Cisco Talos analyzes how attackers abuse vulnerable Windows drivers to escalate privileges, load unsigned kernel code, and disable security tools, documenting ransomware use and explaining Windows mitigations and defensive measures.
Key points
- BYOVD attacks load legitimate but vulnerable drivers and exploit them to gain kernel-level capabilities.
- The article identifies arbitrary MSR writes, arbitrary kernel memory writes, and insufficient access controls as common driver vulnerability classes.
- Attackers use vulnerable drivers to escalate privileges, load unsigned kernel code, disable EDR tools, and—in some campaigns—overwrite disks.
- Talos describes ransomware groups including Kasseika, Akira, Qilin, BlackByte, and RansomHub using BYOVD techniques.
- Windows driver signing, VBS, HVCI, kernel Control Flow Guard, and kernel shadow stacks raise barriers, but legacy vulnerable drivers remain a risk.
- The article recommends enforcing driver policies, using the vulnerable-driver blocklist, and monitoring driver-load events such as Sysmon Event ID 6.
Article Details
- Attack Vectors
- Bring Your Own Vulnerable Driver (BYOVD): attackers install and exploit vulnerable legacy Windows drivers to perform kernel memory or MSR operations, misuse driver functionality, escalate privileges, load unsigned kernel code, or disable security tools.
- The article describes Kasseika using viragt64.sys to terminate security-related processes, Akira using zamguard64.sys via PowerTool to disable EDR, and Qilin using Killer Ultra to exploit the Zemana Anti-Keylogger driver vulnerability CVE-2024-1853.
- BlackByte attacks used four vulnerable drivers—RtCore64.sys, DBUtil_2_3.sys, zamguard64.sys, and gdrv.sys—as part of a BYOVD chain facilitating host encryption.
- RansomHub used EDRKillShifter to unpack and execute a payload that exploited vulnerable drivers, escalated privileges, and disabled EDR processes. Reported driver-related activity involved RentDrv2 and ThreatFireMonitor.
- The article also describes exploiting a Lenovo driver affected by CVE-2022-3699 for arbitrary memory reads and writes, and using a Dell driver with arbitrary memory-write capability to disable EDR.
- Defensive Notes
- Enforce the use of appropriately signed and certified drivers, including Extended Validation and Windows Hardware Quality Labs-certified drivers.
- Use the Windows vulnerable-driver blocklist through Windows Defender Application Control or Windows Security to prevent known vulnerable drivers from loading.
- Monitor driver-load events, including Sysmon event ID 6.
- The article notes that the vulnerable-driver blocklist is enabled by default on systems running the Windows 11 2022 update or with HVCI enabled, but that newly discovered or unlisted vulnerable drivers may remain a risk.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationAttackers exploit vulnerable Windows drivers to escalate privileges, including replacing a process access token or gaining kernel-level privileges.T1486 · Data Encrypted for ImpactBlackByte leveraged BYOVD in attacks that facilitated host encryption.T1543.003 · Windows ServiceKasseika and RansomHub create and start a service to load a vulnerable driver.T1562.001 · Disable or Modify ToolsThe article describes BYOVD payloads terminating EDR or other security-tool processes, including in activity involving Kasseika, Akira, Qilin, and RansomHub.
CVE
CVE-2022-3699Lenovo Mapper code is used to deploy an unsigned cheat driver using the previously mentioned arbitrary memory write vulnerability CVE-2022-3699CVE-2024-1853arbitrary process termination vulnerability impacting Zemana Anti-Keylogger driver “ ”, tracked as CVE-2024-1853. The vulnerability enables attackers with the ability to terminate processes. Upon execution, Killer
People
Chris NealArticle author and contributor to the vulnerable Windows driver research.Connor McGarrThanked for previous work analyzing driver vulnerabilities; also cited for exploit-development research.James NutlandArticle author and contributor to the vulnerable Windows driver research.Michal PoslušnýThanked for previous work analyzing driver vulnerabilities and cited for research on signed kernel drivers.Nicole HoffmanArticle author and contributor to the vulnerable Windows driver research.Russell SanfordThanked for previous work analyzing driver vulnerabilities.Ryan WarnsThanked for previous work analyzing driver vulnerabilities and cited for driver research.Tim HarrisonThanked for previous work analyzing driver vulnerabilities and cited for driver research.Vanja SvajcerArticle author and contributor to the vulnerable Windows driver research.
Threat Actors
AkiraObserved abusing the Zemana kernel driver via PowerTool to disable EDR.BlackByteRansomware group whose attacks used vulnerable drivers in a BYOVD chain facilitating host encryption.KasseikaRansomware operators observed abusing a vulnerable driver to terminate security-related processes.QilinRansomware group observed using Killer Ultra and a vulnerable driver to disable security tools.RansomHubRansomware actors observed using EDRKillShifter and vulnerable drivers to disable security tools.Scattered SpiderThe article says its members have used BYOVD tactics since at least December 2022 and may have joined forces with Qilin and RansomHub.
Malware
EDRKillShifterIn August 2024, RansomHub ransomware actors were observed using a new malware known as EDRKillShifter to disable security tools prior to executing the ransomware binary. The EDRKillShifter can act as a loader for aGh0stRATTo showcase an example of malware exploiting vulnerable drivers to terminate EDR tools, we chose a Gh0stRAT campaign from September 2024. The dropper drops an executable “nthandlecallback.exe”, a vulnerable Dell binaryHermeticWipercampaign, a RawDisk driver from Eldos was used to overwrite hard drives, while in February 2022, HermeticWiper used a proxy physical disk writing driver from “EaseUS Partition Master” driver partition managerKiller Ultraransomware group, another group operating under a Raas model, was observed using a new malware dubbed “Killer Ultra” within an attack. Killer Ultra has a plethora of capabilities, including the ability to terminateShamoondrivers with insufficient access controls, have been used in some advanced attacks. For example, in the Shamoon campaign, a RawDisk driver from Eldos was used to overwrite hard drives, while in February 2022,Sinowalcode into kernel mode was an incentive for the creation of several Windows kernel rootkits, such as Sinowal or TDL4, designed to hide the presence of malicious payloads from defenders by modifying kernel programsTDL4into kernel mode was an incentive for the creation of several Windows kernel rootkits, such as Sinowal or TDL4, designed to hide the presence of malicious payloads from defenders by modifying kernel programs and data
Vendors
Dellcampaign from September 2024. The dropper drops an executable “nthandlecallback.exe”, a vulnerable Dell binary utilities driver “dbutil_2_3.sys”, and a ZIP file with the name “tree.exe”. The ZIP contains anEaseUShard drives, while in February 2022, HermeticWiper used a proxy physical disk writing driver from “EaseUS Partition Master” driver partition manager “empntdrv.sys” for overwriting drives. HermeticWiper containedEldoshave been used in some advanced attacks. For example, in the Shamoon campaign, a RawDisk driver from Eldos was used to overwrite hard drives, while in February 2022, HermeticWiper used a proxy physical diskGIGABYTEAnti-Malware (ZAM) application exploited by other threat actors, and gdrv.sys, a component of is the GIGABYTE tools software package for GIGABYTE motherboards. Lenovodriver. There are several open-source unsigned device drivers loading utilities. In one instance, Lenovo Mapper was used as a base to develop a game cheat utility “sexy_girl_addy.exe”, which was uploaded toMicrosoftdrivers must be signed with a valid extended validation (EV) certificate by the developer, pass the Microsoft Hardware Lab Kit (HLK) compatibility tests, and be signed by the Microsoft Dev Portal. MSIdrivers described in previous reports.These drivers consisted of RtCore64.sys, a driver originally used by MSI Afterburner a system overclocking utility, DBUtil_2_3.sys, a driver that is part of the Dell ClientTG Softbe an old version of an antimalware software driver “viragt64.sys” (VirIT Agent System) developed by TG Soft, which exposes the functionality of terminating a process from the kernel mode to users with lower levelsZemanaIn March 2024, Akira has been observed abusing the legitimate, signed Zemana anti-malware kernel driver “zamguard64.sys” via PowerTool to disable EDR at the kernel level. The exploitation of the Zemana zamguard driver
Products
Dell Client firmware update utilityAfterburner a system overclocking utility, DBUtil_2_3.sys, a driver that is part of the Dell Client firmware update utility, zamguard64.sys, a part of the previously mentioned Zemana Anti-Malware (ZAM) applicationEaseUS Partition Masterdrives, while in February 2022, HermeticWiper used a proxy physical disk writing driver from “EaseUS Partition Master” driver partition manager “empntdrv.sys” for overwriting drives. HermeticWiper contained fourGIGABYTE tools software package(ZAM) application exploited by other threat actors, and gdrv.sys, a component of is the GIGABYTE tools software package for GIGABYTE motherboards. Microsoft WindowsExploring vulnerable Windows driversMSI Afterburnerdescribed in previous reports.These drivers consisted of RtCore64.sys, a driver originally used by MSI Afterburner a system overclocking utility, DBUtil_2_3.sys, a driver that is part of the Dell Client firmwareValorantLenovo Mapper to load a driver which seems to attempt to disable the TPM-based license check in the game Valorant. VirIT antivirus softwareransomware operators abused a vulnerable driver, “viragt64.sys”, which is part of the legitimate VirIT antivirus software, to disable a pre-determined list of 991 processes related to security tools and systemWindows Defender Application Controlvulnerable drivers to tackle this issue. At the beginning, the list was included into the Windows Defender Application Control feature and was superseded by the Windows Security application in newer Windows versions. Windows Securitylist was included into the Windows Defender Application Control feature and was superseded by the Windows Security application in newer Windows versions. Zemana Anti-MalwareIn March 2024, Akira has been observed abusing the legitimate, signed Zemana anti-malware kernel driver “zamguard64.sys” via PowerTool to disable EDR at the kernel level. The exploitation of the Zemana zamguard driver
Tools
Lenovo Mapperdriver. There are several open-source unsigned device drivers loading utilities. In one instance, Lenovo Mapper was used as a base to develop a game cheat utility “sexy_girl_addy.exe”, which was uploaded toPowerToolhas been observed abusing the legitimate, signed Zemana anti-malware kernel driver “zamguard64.sys” via PowerTool to disable EDR at the kernel level. The exploitation of the Zemana zamguard driver was a main componentRealBlindingEDR“irrlicht.dll” and an encrypted file “server.log”. “EDR.exe” is a variant of the open-source tool RealBlindingEDR used to disable EDR programs by exploiting arbitrary memory write vulnerability in Dell’s binaryRentDrv2defense evasion. Recent exploits used by the adversary are related to POCs found on Github leveraging RentDrv2, while the other exploited a driver called ThreatFireMonitor. The adversary initiated the process bySysmonApart from the above, for threat detection and response, it recommended to develop a capability to monitor driver load events, such as those recorded by Sysmon’s event ID 6. Terminatorat the kernel level. The exploitation of the Zemana zamguard driver was a main component of the popular Terminator EDR killer tool listed for sale on illicit marketplaces beginning May 2023.