Exploring vulnerable Windows drivers
Summary: Cisco Talos research into Bring Your Own Vulnerable Driver attacks identified three payload classes - privilege escalation via kernel memory writes, loading unsigned malicious code into the kernel, and terminating EDR tools - and tied the technique to ransomware groups including Kasseika, Akira, Qilin, RansomHub and BlackByte. Kasseika abused the VirIT antivirus driver viragt64.sys to target a hard-coded list of 991 security and system processes, while BlackByte's July 2024 encryptor dropped four vulnerable drivers (RtCore64.sys, DBUtil_2_3.sys, zamguard64.sys and gdrv.sys) in attacks investigated by Talos IR.
Bottom line: Microsoft's vulnerable driver blocklist is on by default only on Windows 11 2022-update systems or those with HVCI enabled, so any machine outside that set can still load a legacy signed driver - and a single one of them is enough to kill your EDR from kernel space.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026