Loading story…
Researchers disclosed two signed Windows kernel drivers that can be abused in bring-your-own-vulnerable-driver (BYOVD) attacks to gain elevated privileges and bypass platform protections. Motorola's SmSerl64.sys from the SM56 Modem WDM Driver package (6.12.23.0) was reported as vulnerable to crafted IOCTL requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as CVE-2024-55414. Separately, Patrick Saif reported that ComputerZ_x64.sys, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted MSR reads that can defeat KASLR, weakly filtered port I/O, and unrestricted PCI configuration writes.
Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's HVCI blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block SmSerl64.sys across endpoints and use published YARA and Sigma detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading IA32_LSTAR, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A public issue documented that ComputerZ_x64.sys was code signed, not on the HVCI blocklist or LOLDrivers, and could be abused for BYOVD on modern x64 Windows systems. The researcher said proof-of-concept testing passed all 10 checks, confirming the exposed capabilities and abuse potential.
Patrick Saif reported a vulnerable signed Windows kernel driver, ComputerZ_x64.sys from Master Lu, to the vendor and submitted a MITRE CVE request. The report said the driver exposed dangerous kernel primitives including physical memory read, MSR read, PCI configuration access, and port I/O.
A GitHub repository published technical details and exploit code for CVE-2025-7771 in ThrottleStop.sys, describing unrestricted IOCTL access that allows mapping physical memory via MmMapIoSpace. The issue enables local privilege escalation and adds another signed driver to the BYOVD abuse landscape.
LOLDrivers published an entry for Motorola's signed SmSerl64.sys driver, describing a flaw that lets low-privileged users map physical memory via crafted IOCTLs. The listing said the issue could enable privilege escalation, code execution, information disclosure, and abuse of the signed driver to bypass Microsoft's driver-signing policy, and included detection and blocking guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
loldrivers.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Fortinet disclosed two techniques that can let attackers load unsigned kernel drivers on Windows systems by tampering with **Driver Signature Enforcement (DSE)** at runtime, despite protections such as Code Integrity, PatchGuard, Virtualization-based Security, and Microsoft’s recommended vulnerable-driver block rules. The methods, dubbed **Page Swapping** and **Callback Swapping**, abuse kernel write access—often obtained through vulnerable third-party drivers—to redirect protected Code Integrity policy data or replace validation callbacks in `ntoskrnl.exe`, causing malicious drivers to be accepted as trusted. The report says Microsoft’s **Kernel Data Protection (KDP)** and driver blocklists raise the bar but do not fully stop runtime DSE tampering when **Hypervisor-protected Code Integrity (HVCI)** is not enabled, because driver validation can still be manipulated in the normal kernel. The findings build on a long history of DSE bypass tradecraft, including Turla-linked tooling such as **TDL**, a loader that mapped specially crafted unsigned drivers into kernel memory without modifying standard Code Integrity variables, underscoring how kernel-level access and vulnerable drivers remain a practical path to stealthy persistence and defense evasion on Windows.
Aug 15, 2026