Huntress Details Tax-Form Malvertising Campaign Using Huawei Driver to Kill EDR

Mar 19, 2026 · Original article ↗

Summary

Huntress reports more than 60 rogue ScreenConnect instances tied to tax-form malvertising. Its analysis details a crypter and signed Huawei driver used to terminate security tools, followed in a separate intrusion by credential theft and network harvesting.

Key points

Huntress says the campaign, active since at least January 2026, used Google Ads for U.S. tax-form searches to deliver rogue ScreenConnect installers; the company observed over 60 related instances across its customer base.
Two cloaking services filtered visitors, while attackers deployed multiple ScreenConnect relays and FleetDeck for redundant remote access.
The FatMalloc crypter used a 2GB memory allocation, indirect shellcode execution through a timer callback, and layered decryption to load HwAudKiller.
HwAudKiller loaded a signed Huawei audio driver that accepted a process ID through an IOCTL and terminated security-tool processes from kernel mode. Huntress says this driver had not appeared in prior public research or listed driver-block resources at the time of analysis.
A separate intrusion involved the same driver-based EDR killer, followed by LSASS credential dumping and attempts to harvest credentials across the network with NetExec.
Huntress recommends investigating unapproved trial ScreenConnect instances, monitoring for kernel driver services and drivers in temporary directories, and scrutinizing executables launched from ScreenConnect working directories.

Article Details

Attack Vectors: Google Ads for tax-form searches redirected users through anukitax[.]com/forminw9/ to bringetax[.]com/humu/, which delivered a rogue ScreenConnect installer.
A separate fake Chrome update page at grinvan[.]com/vims/browser/ instructed victims to download and run an updater; its JavaScript fetched victim geolocation and notified the operator through a Telegram bot.
Adspect and JustCloakIt cloaking layers fingerprinted visitors and served malicious content to selected visitors while showing safe content to scanners and researchers.
ScreenConnect sessions ran the FatMalloc crypter, which used a 2GB allocation, indirect shellcode execution through timeSetEvent, and staged decryption and loading before launching HwAudKiller.
HwAudKiller loaded the signed Huawei audio driver HWAuidoOs2Ec.sys and used its process-termination IOCTL to kill security-tool processes from kernel mode.
In a separate intrusion, access reportedly followed a VPN compromise and RDP authentication from an attacker-controlled workstation; the operator dumped LSASS memory and used NetExec for network-wide credential harvesting.
Defensive Notes: Train users that sponsored search results are not inherently trustworthy; direct tax-form downloads to IRS.gov or known employer portals.
Maintain an allowlist of approved RMM tools and relay hostnames; investigate unexpected trial ScreenConnect instances, particularly instance-* relays or sessions using y=Guest.
Monitor for multiple ScreenConnect relays and backup RMM tools such as FleetDeck Agent appearing on one host.
Alert on kernel driver service creation from non-standard paths, especially %TEMP%, and monitor for the Havoc service and Havoc.sys in temporary directories. The article cites Sysmon Event ID 6 and Event ID 7045.
Investigate unsigned or unknown executables launched from C:\Windows\SystemTemp\ScreenConnect\ directories, especially those that spawn child processes or load kernel drivers.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`fioclouder[.]com`	Listed in the article's campaign indicators of compromise; its specific role is not described.
DOMAIN	`friugrime[.]com`	Listed in the article's campaign indicators of compromise; its specific role is not described.
DOMAIN	`gripsmonga[.]sbs`	Self-hosted ScreenConnect relay used by the attacker on a compromised host.
DOMAIN	`jcibj[.]com`	Domain used for the JustCloakIt cloaking layer in the campaign.
HOSTNAME	`instance-gcfox6-relay[.]screenconnect[.]com`	Trial ScreenConnect relay listed among campaign indicators of compromise.
HOSTNAME	`instance-itsd8c-relay[.]screenconnect[.]com`	Trial ScreenConnect relay used by the attacker.
HOSTNAME	`instance-sl1mb9-relay[.]screenconnect[.]com`	Additional trial ScreenConnect relay deployed by the attacker.
HOSTNAME	`instance-t5sady-relay[.]screenconnect[.]com`	Trial ScreenConnect relay listed among campaign indicators of compromise.
HOSTNAME	`instance-vdquvd-relay[.]screenconnect[.]com`	Trial ScreenConnect relay listed among campaign indicators of compromise.
HOSTNAME	`instance-zichgu-relay[.]screenconnect[.]com`	Trial ScreenConnect relay listed among campaign indicators of compromise.
SHA256	`033f42102362a8d8d4bdba870599eb5e0c893d8fd8dd4bc2a4b446cbbeb59b99`	SHA-256 of the BYOVD AV/EDR-killer payload.
SHA256	`0821661e715fe64bb39f4fece277737a48fd6839edd40ec8a4a39bf04cea8524`	SHA-256 of the decoded shellcode containing the PE loader.
SHA256	`28278b8c85c832417f9860fe8ea3ddbb9ff1d5860317db4813227a3a52b7c7cc`	SHA-256 of sent.exe, a separate-intrusion variant of the HwAudKiller tool.
SHA256	`2b409a265f571dccde6ef4860831c1b03d5418d1951f97925315dc5b0891da04`	SHA-256 of the XOR-encrypted shellcode embedded in crypteds.exe.
SHA256	`5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db`	SHA-256 of Havoc.sys, the Huawei audio driver abused to terminate processes.
SHA256	`7509365935fc1bfadba20656698d3a29051031635419043bc2bc45116106e026`	SHA-256 of form_w9.msi, the rogue ScreenConnect installer.
SHA256	`8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531`	SHA-256 of FatMalloc, the crypter delivered through ScreenConnect.
URL	`hxxps[:]//jcibj[.]com/pcl.php`	JustCloakIt backend endpoint contacted by the malicious landing page for visitor filtering.