Signed vulnerable drivers used to disable EDR and aid ransomware attacks

Researchers and incident responders reported continued abuse of Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint protections, including CrowdStrike Falcon, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as 0x22E010 that accepted a process ID and invoked ZwOpenProcess and ZwTerminateProcess from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed PoisonKiller demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers.

Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of Terminator and related tools built around vulnerable Zemana drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as AuKill when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.