STONESTOP
STONESTOP is a Windows userland malware utility used to load, install, and control the malicious kernel driver POORTRY (also called BurntCigar). It functions as both a loader/installer for POORTRY and an orchestrator that communicates with the driver, including via DeviceIoControl and hardcoded IOCTLs, to carry out defense-evasion actions. Public reporting describes the STONESTOP/POORTRY toolkit as designed to terminate antivirus and EDR processes; newer reporting also ties the toolkit to deletion of critical EDR files from disk, making it an EDR wiper as well as an EDR killer. SentinelOne also reported related capabilities across versions including killing, suspending, resuming, deleting, or overwriting targeted processes and files.
The toolkit has been observed in bring-your-own-vulnerable-driver or malicious signed-driver style attacks to disable security products on Windows systems. Reporting states STONESTOP creates and loads the driver, after which POORTRY performs kernel-level tampering against security software. Associated POORTRY capabilities described in the source material include process termination, file deletion, file overwrite, patching or disabling kernel callbacks tied to security products, interfering with filter drivers, and detaching device objects. STONESTOP has been described as heavily obfuscated in some campaigns, alongside POORTRY, using packers such as VMProtect, Themida, and ASMGuard.
STONESTOP has been linked to multiple financially motivated and ransomware-related actors and intrusions. Mandiant documented UNC3944 / Scattered Spider using STONESTOP with POORTRY to disable defenses. Additional reporting associates the toolkit with Akira threat actors and with attacks involving or linked to ALPHV/BlackCat, Cuba, Medusa, LockBit, and RansomHub; public reporting also notes use by affiliates in Medusa ransomware attacks and references use in pre-ransomware activity. SentinelOne assessed with high confidence that similar malicious-driver capability was likely supplied to multiple threat actors rather than independently developed.
Observed targeting and victimology in the supporting content span telecommunications, BPO, MSSP, financial services, entertainment, transportation, cryptocurrency, healthcare/medical, and banks in Francophone African countries. The malware is used specifically to impair or remove endpoint protections prior to follow-on intrusion activity or ransomware deployment.
High-confidence identifiers and artifacts directly mentioned in the content include the paired component names STONESTOP and POORTRY/BurntCigar; configuration artifact poyuo.pdata in an early STONESTOP variant; and sample filenames c7iy3d.exe identified as Stonestop and usnnr.sys identified as Poortry in one July 2024 incident.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Scattered Spider has been linked to exploitation of ... legacy bugs like CVE-2015-2291 in Intel driver software to run code in kernel mode.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mandiant documented a financially motivated threat group it calls UNC3944 using this same driver to disable defenses. It referred to this driver as POORTRY and the malware that uses it as STONESTOP.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Persistence
1 technique
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
use a loader named ‘STONESTOP’ to install a malicious signed driver dubbed ‘POORTRY’, which is designed to terminate processes associated with security software and to delete files as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.
Stealth
6 techniques
Stealth
Poortry has evolved into something akin to a rootkit that also has with finite controls over a number of different API calls used to control low-level operating system functionality.
The second version was VMProtected and signed through the WHQL signing process. The third version was also signed through the WHQL signing process, but was protected with an unidentified packer.
Before reading from the file, STONESTOP verifies the file’s integrity against a predefined MD5 hash... reads process names from an external configuration file named, for example, poyuo.pdata.
Poortry now can also delete critical EDR components completely, instead of simply terminating their processes... The loader contains a list of hardcoded paths pointing at the location where EDR products are installed... and deletes files critical to the EDR agent, such as EXE files or DLL files.
SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions... a threat actor utilizing a Microsoft signed malicious driver to attempt evasion of multiple security products. | The toolkit contains simple protection mechanisms used to prevent its repurpose, reuse, and redistribution... STONESTOP functions as both a loader/installer for POORTRY.
Defense Impairment
1 technique
Defense Impairment
Discovery
1 technique
Discovery
Command and Control
2 techniques
Command and Control
Impact
2 techniques
Impact
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader often used together with the Poortry malicious driver.
User-mode loader paired with Poortry that locates and communicates with the malicious driver via DeviceIoControl, performs a handshake, sends IOCTLs to trigger driver capabilities, and helps terminate processes and delete EDR-related files.
A user-mode loader paired with Poortry that locates and communicates with the malicious kernel driver via DeviceIoControl, performs a handshake, sends IOCTLs to trigger impairment features, kills targeted processes, and directs deletion of EDR-related files from disk.
STONESTOP is an EDR killer malware used to terminate endpoint security products, often delivered as part of ransomware attacks using BYOVD techniques.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.