Huntress Details SonicWall VPN Intrusion and EnCase Driver Used to Target Security Tools
Summary
Huntress says attackers used compromised SonicWall SSLVPN credentials, then deployed an EDR killer that abused an EnCase driver to terminate security processes. Huntress disrupted the intrusion before ransomware was deployed.
Key points
- Huntress traced initial access to compromised SonicWall SSLVPN credentials; the account lacked MFA.
- The EDR killer decoded a kernel driver concealed as space-separated English words, then wrote it to disk and registered it as a Windows kernel service.
- The EnCase driver’s KillProc function let the attacker terminate security processes from kernel mode; the killer repeatedly checked for targeted processes.
- Huntress says the attack was disrupted before ransomware deployment, after SIEM and endpoint telemetry helped identify the activity and quarantine affected systems.
- The driver’s certificate had expired and been revoked, but its pre-2015 signing and timestamp allowed Windows to accept it under the conditions described.
- Huntress recommends MFA for remote access, reviewing VPN logs, enabling HVCI or Memory Integrity, and applying Microsoft vulnerable-driver blocks.
Article Details
- Attack Vectors
- The attacker used compromised SonicWall SSLVPN credentials without multi-factor authentication to access the victim network.
- After access, the attacker performed network reconnaissance using ICMP ping sweeps, NetBIOS name-request probes, and SMB-targeted activity.
- The attacker deployed an EDR-killer binary that decoded and installed the EnCase EnPortv.sys driver, then used its kernel-mode KillProc IOCTL to terminate security processes.
- Defensive Notes
- Enable MFA on remote-access services and review VPN logs for anomalous successful logins and denied attempts preceding access.
- Enable HVCI or Memory Integrity so Microsoft's Vulnerable Driver Blocklist is enforced.
- Use Microsoft's recommended driver block rules through WDAC and enable the ASR rule “Block abuse of exploited vulnerable signed drivers.”
- Monitor for kernel services with OEM- or hardware-like names created outside normal software deployment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]160[.]216[.]221 | Source IP for a denied SonicWall portal login attempt shortly before the successful VPN authentication; reported as attacker-related. |
| IPV4 | 69[.]10[.]60[.]250 | Source IP for the successful SonicWall SSLVPN authentication attributed to the attacker. |
| SHA256 | 3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee0 | SHA-256 hash identified in the IOC list for the EnCase driver OemHwUpd.sys. |
| SHA256 | 6a6aaeed4a6bbe82a08d197f5d40c2592a461175f181e0440e0ff45d5fb60939 | SHA-256 hash identified in the IOC list for the EDR-killer binary svchost.exe. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe EDR-killer binary concealed its embedded driver by encoding each byte as a word from an embedded dictionary.T1036.005 · Match Legitimate Resource Name or LocationThe binary masqueraded as a legitimate firmware update utility and used OEM-like service names.T1046 · Network Service DiscoveryThe attacker performed network reconnaissance that included ICMP sweeps, NetBIOS name-request probes, and SMB-targeted activity.T1068 · Exploitation for Privilege EscalationThe attacker abused the signed EnCase driver to obtain kernel-mode process-termination capability that bypassed user-mode protections.T1070.006 · TimestompThe binary copied timestamps from ntdll.dll to the dropped driver to make it blend in with system files.T1133 · External Remote ServicesThe attacker gained initial access by authenticating to the victim's SonicWall SSLVPN.T1543.003 · Windows ServiceThe binary registered OemHwUpd.sys as a Windows kernel service to load the driver.T1562.001 · Disable or Modify ToolsThe attacker used the EnCase driver’s KillProc IOCTL to terminate endpoint security processes.
Vendors
Guidance SoftwareOnce inside, the attacker deployed an EDR killer that abuses a legitimate Guidance Software (EnCase) forensic driver with a revoked certificate to terminate security processes from kernel mode, a technique known asMicrosoftSince Windows Vista x64, Microsoft has required all kernel-mode drivers to be digitally signed by a trusted Certificate Authority.SonicWallHomeBlogThey Got In Through SonicWall. Then They Tried to Kill Every Security Tool
Products
EnCaseOnce inside, the attacker deployed an EDR killer that abuses a legitimate Guidance Software (EnCase) forensic driver with a revoked certificate to terminate security processes from kernel mode, a technique known asMicrosoft WindowsThe EnCase driver's certificate expired in 2010 and was subsequently revoked, yet Windows still loads it, a gap in Driver Signature Enforcement that attackers continue to exploit.SonicWall SSL VPNIn early February 2026, Huntress responded to an intrusion where threat actors leveraged compromised SonicWall SSLVPN credentials to gain initial access to a victim network.