Loading malware…
HIDDENDRIVER is a Windows kernel rootkit derived from the open-source Hidden project. It was used in REF3927 activity, an opportunistic campaign attributed to a Chinese-speaking threat actor that compromised Windows IIS/ASP.NET servers and deployed multiple post-exploitation tools. HIDDENDRIVER uses Direct Kernel Object Manipulation to conceal processes, including unlinking process objects from system process-tracking structures. It also registers kernel object, process-creation, file-system minifilter, and registry callbacks to hide configured processes, files, directories, registry keys, and registry values, and can restrict access to protected processes. A Chinese-language user-mode controller, referred to as HIDDENCLI or HijackDriverManager, configures the driver and issues IOCTL commands to enable or disable functions and manage hidden objects and process rules. Its primary purpose is defense evasion by concealing malicious payloads and associated artifacts on compromised Windows systems.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Internally, we are calling the rootkit HIDDENDRIVER and the userland application HIDDENCLI. This malicious software is a modified version of the open source rootkit Hidden.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacker hid their presence on the infected machine by deploying a kernel rootkit... Internally, we are calling the rootkit HIDDENDRIVER and the userland application HIDDENCLI.
If a process needs to be hidden, it is unlinked from the ActiveProcessLinks list... the callback checks the postponeHiding flag; if set, it calls UnlinkProcessFromCidTable to remove it from the master process ID table.
FltCreatePreOperation checks the path against its list of files to be hidden... FltDirCtrlPostOperation intercepts the directory listing generated by the system and modifies it by removing any files listed as hidden.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.