Forest Global Training Partners

Cyber Risks · Cisco Talos

Undocumented driver-based browser hijacker Red Driver targets Chinese speakers and internet cafes

Summary: Cisco Talos documented RedDriver, an undocumented malicious Windows driver that uses stolen code-signing certificates and the HookSignTool timestamp-forging tool to bypass driver signature enforcement, then imports Windows Filtering Platform functions to rewrite hijacked browser traffic to 127.0.0.1 and a listening port opened by the DnfClient payload. The infection chain starts with a UPX-packed executable named DnfClientShell32.exe that reflectively injects DnfClient, targets a hardcoded list of Chinese-language browser process names plus Chrome and Edge, and appears in an earlier version active since at least 2021, with all observed C2 domains resolving to IP addresses in China.

What you should know: Talos reports no crashes or blue screens during analysis and notes the authors used Jenkins in their build pipeline, so this is skilled driver development rather than opportunistic malware. The end goal of the traffic redirection is still unclear, but any infected system has all browser traffic open to tampering at the packet level.

Read the original at Cisco Talos ↗

Topics
Malware
Related