Loading story…
Multiple threat actors used malicious but legitimately signed Microsoft kernel drivers in targeted intrusions across telecommunications, BPO, MSSP, financial, and other sectors, according to SentinelOne. The toolkit combined the STONESTOP userland component with the POORTRY kernel driver to evade defenses by terminating, suspending, and resuming antivirus and EDR processes; later variants also added file deletion and overwrite functions. SentinelOne identified three versions of the toolkit, including two signed through Microsoft’s WHQL process, indicating that attackers were able to weaponize trusted driver signing to operate at the kernel level while undermining endpoint protections.
SentinelOne said it first reported the issue to Microsoft’s Security Response Center in October 2022 under case 75361, after which Microsoft published advisory ADV220005. The company also linked similar signed-driver abuse to a separate intrusion that ended with Hive ransomware deployment in the medical sector. Based on repeated use by distinct intruders, SentinelOne assessed with high confidence that the drivers were likely supplied through a service model, enabling multiple actors to buy or obtain signed kernel tools specifically built to neutralize security software during attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Based on its investigation, SentinelOne assessed with high confidence that different threat actors used similar malicious signed drivers likely developed and supplied as a service. The finding suggested a shared ecosystem enabling multiple intrusion sets to leverage the same defense-evasion tooling.
SentinelOne linked similar abuse of signed malicious drivers to a separate intrusion in the medical sector that culminated in Hive ransomware deployment. This indicated the technique was being used across distinct operations rather than a single campaign.
A later version of the malicious signed driver toolkit added capabilities to delete and overwrite files, expanding beyond process tampering for defense evasion. SentinelOne identified three toolkit versions overall, including two signed through Microsoft's WHQL process.
Multiple threat actors used a toolkit built around the POORTRY kernel driver and STONESTOP userland component during active intrusions against telecommunications, BPO, MSSP, financial, and other sectors. The tooling was primarily used to evade defenses by terminating, suspending, and resuming AV and EDR processes.
After SentinelOne's disclosure, Microsoft published security advisory ADV220005 addressing the issue of malicious drivers signed through its ecosystem. The advisory marked Microsoft's formal response to the reported abuse.
SentinelOne said it first disclosed the abuse of malicious Microsoft-signed kernel drivers to the Microsoft Security Response Center under case 75361. The disclosure concerned a toolkit including the POORTRY driver and STONESTOP component used to evade security tools during intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026