Loading malware…
POORTRY, also referred to as BurntCigar, is a malicious Windows kernel-mode driver used to disable security controls on victim systems. It is commonly paired with the loader STONESTOP, which installs or communicates with the driver and directs its actions. Public reporting describes POORTRY as part of a small toolkit designed to terminate antivirus and EDR processes, evade detection, and facilitate follow-on intrusion activity including ransomware deployment.
The malware has been used in Bring Your Own Vulnerable Driver (BYOVD) style operations and in campaigns involving signed malicious or vulnerable drivers. Reporting states that operators have used stolen or leaked certificates, forged timestamps, and Microsoft attestation/WHQL signing to bypass Windows driver signature enforcement. POORTRY has been observed protected with packers including VMProtect, Themida, and ASMGuard, and some samples masqueraded as legitimate drivers such as idmtdi.sys.
Core functionality consistently reported includes terminating selected processes on Windows systems, especially endpoint protection agents. Additional reporting shows the toolkit can suspend and resume processes, and newer variants add file tampering capabilities including deletion or overwrite of files. Sophos reported that newer POORTRY variants evolved beyond process killing into patching or disabling kernel callbacks, interfering with filter drivers, detaching device objects, killing security processes, and deleting critical EDR executables and DLLs from disk, effectively acting as an EDR wiper. SentinelOne similarly reported IOCTL-driven capabilities for process tampering and later file deletion and overwrite.
POORTRY is associated with multiple financially motivated and ransomware-linked actors. Mandiant documented its use by UNC3944, also known as Scattered Spider, to disable defenses. Reporting also links similar or the same toolkit to ALPHV/BlackCat affiliates, Akira threat actors, and ransomware operations including Cuba, Hive, Medusa, LockBit, RansomHub, and in some reporting Bluebottle/OPERA1ER and Osiris-related activity. Public reporting notes that a similar toolkit was likely supplied to multiple threat actors rather than independently developed by each.
Observed use cases include terminating security software during intrusions, clearing the way for ransomware execution, and supporting SIM-swapping or telecom-focused compromises attributed to Scattered Spider/UNC3944. Targeted environments mentioned in reporting include Windows enterprise endpoints across sectors such as telecommunications, BPO, MSSP, financial services, healthcare, entertainment, transportation, cryptocurrency, and banks in Francophone Africa.
High-confidence identifiers and relationships from the content include the aliases BurntCigar and POORTRY, the paired loader STONESTOP, and reported use of hardcoded DeviceIoControl/IOCTL interfaces for process and file operations. Specific signer names and publisher metadata mentioned in reporting include FEI XIAO, bopsoft, Evangel Technology (HK) Limited, 大连纵梦网络科技有限公司, and Luck Bigger Technology Co., Ltd.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Scattered Spider is known to exploit CVE-2015-2291 which is a vulnerability in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys) that allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges... Scattered Spider exploited CVE-2015-2291 to deploy a malicious kernel driver in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys). | Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to Mandiant, these drivers are part of a toolkit that consists of two components, STONESTOP (loader) and POORTRY (kernel-mode driver). A similar toolkit has been used by different threat actors, such as the Cuba and Hive ransomware groups.
"Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint."
The attackers used the known POORTRY driver... for the purposes of killing security software during this attack
22 distinct techniques documented for this family, organized by ATT&CK tactic.
POORTRY is a malicious driver used to terminate selected processes on Windows systems... STONESTOP is a Windows userland utility that attempts to terminate processes by creating and loading a malicious driver.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
The threat actors also leverage known system vulnerabilities using “Bring Your Own Vulnerable Driver” (BYOVD) techniques to gain administrative privileges and evade detection from endpoint security products.
The binary is a 64-bit Windows PE driver named smuol.sys, and imitates a legitimate CrowdStrike Falcon driver.
this function starts with an attempt to call the function VmProtectBeginVirtualization()... threat actors also abuse it to try and thwart malware analysis.
Notably, it tries to masquerade by using the same information in its properties sheet as a driver (idmtdi.sys) for a commercially available software... the attackers merely cloned the information from it.
Poortry now can also delete critical EDR components completely, instead of simply terminating their processes... The loader contains a list of hardcoded paths pointing at the location where EDR products are installed... and deletes files critical to the EDR agent, such as EXE files or DLL files.
The vulnerable drivers used by Scattered Spider are signed by stolen certificates from well-known authorities, such as Microsoft, NVIDIA, and Global Software LLC, which makes them appear legitimate.
SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions... a threat actor utilizing a Microsoft signed malicious driver to attempt evasion of multiple security products.
Scattered Spider typically exploits vulnerabilities such as CVE-2015-2291 and utilize tools like STONESTOP and POORTRY to terminate security software and evade detection.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
110 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious Windows kernel driver used to terminate selected processes, particularly security and EDR software, to evade detection. It has been signed with a Microsoft Windows Hardware Compatibility Authenticode signature to help bypass trust controls.
Driver used in BYOVD attacks to disarm security tools in conjunction with the Osiris ransomware operation.
BYOVD-associated defense-evasion tool referenced as commonly used by ransomware groups to disable security products prior to encryption.
A malicious driver, also called BurntCigar, often used with the Stonestop loader; unlike many drivers, it may have been developed by attackers and successfully signed.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.