Cybersecurity researchers have identified a sophisticated attack method being used by prominent ransomware groups to neutralize endpoint detection and response (EDR) software on targeted systems. This technique, which leverages legitimate but vulnerable software drivers, poses a significant challenge to organizational security postures worldwide.
According to detailed reports from Cisco Talos and Trend Micro, threat actors linked to the Qilin and Warlock ransomware operations are actively employing a strategy known as Bring Your Own Vulnerable Driver (BYOVD). This approach allows attackers to bypass standard security measures by installing compromised, yet signed, drivers that have known security flaws.
The malicious drivers are then used to gain high-level system privileges, specifically kernel-mode access. This level of access is the highest within an operating system, granting the attacker near-total control. From this position, they can directly interfere with the core functions of security software.
Technical Execution of the Attacks
In attacks analyzed by Talos, the Qilin ransomware group was observed deploying a malicious dynamic-link library (DLL) file named “msimg32.dll.” This file is a clever imitation of a legitimate Windows library file, a tactic known as DLL sideloading. By placing this file in a specific directory, attackers can trick the system into loading their malicious code instead of the genuine Microsoft file.
Once executed, this malicious payload is responsible for delivering and installing the vulnerable driver. The driver acts as a powerful tool for the ransomware, enabling it to disable or uninstall security tools without triggering alerts that would normally occur from user-space applications.
Researchers note that this method is particularly effective because it exploits the inherent trust that operating systems place in signed drivers. Even if the driver version is old and contains publicly known vulnerabilities, its digital signature from a legitimate hardware vendor often allows it to pass initial security checks.
The Scale of the Threat
The impact of this technique is broad. Analysis indicates that the tools used in these campaigns are capable of disabling more than 300 different EDR and antivirus products. This extensive coverage suggests the attackers have invested considerable resources into understanding and countering a wide array of commercial and enterprise security solutions.
Endpoint Detection and Response tools are critical components of modern cybersecurity defenses. They continuously monitor and collect data from endpoints like laptops and servers, analyzing this data for signs of malicious activity. Disabling these tools effectively blinds security teams to the ransomware’s actions during the crucial early stages of an attack.
This silence allows the threat actors to move laterally across a network, escalate privileges, and deploy their ransomware payload without obstruction. The first indication of a breach for many organizations may be the encryption of their files and the arrival of a ransom note.
Context and Industry Response
The BYOVD technique is not new, but its adoption by major ransomware-as-a-service (RaaS) groups like Qilin and Warlock marks an escalation. It represents a shift towards more advanced, evasive tactics that were once primarily the domain of state-sponsored actors. This commodification of advanced techniques lowers the barrier to entry for other cybercriminal groups.
In response, security firms and operating system vendors have developed mitigations. Microsoft, for instance, has introduced features like Hypervisor-Protected Code Integrity (HVCI) and vulnerable driver blocklists in Windows. These features can prevent unauthorized or known-bad drivers from loading in kernel memory.
However, widespread adoption of these security features can be inconsistent across organizations due to potential compatibility issues with legacy hardware or specialized software. This inconsistency creates opportunities for attackers to find systems where these protections are not fully enabled.
Security experts recommend a layered defense strategy. This includes ensuring that all driver allow-listing and block-listing features are activated where possible. Furthermore, maintaining rigorous patch management for all software, including hardware drivers, is essential to eliminate the vulnerable components attackers seek to exploit.
Looking ahead, the cybersecurity community anticipates that the use of BYOVD attacks will continue to rise among ransomware operators. The success of this technique against a wide range of EDR tools provides a compelling return on investment for these criminal groups. Researchers are closely monitoring for new vulnerable drivers being added to attacker toolkits and for variations in the deployment methods, such as the use of different malicious DLLs or exploitation of other legitimate software processes. The ongoing cat-and-mouse game between defenders implementing stronger kernel protections and attackers discovering new bypasses is expected to define this threat landscape for the foreseeable future.
