Loading story…
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed wskmon.sys, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes 7F 4E 54 46. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts.
Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s 360netmon_wfp.sys, tracked as Win64/VulnDriver.Qihoo360.A, and IObit Malware Fighter’s IMFForceDelete.sys, associated with CVE-2019-6494. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via IOCTL 0x8016E000. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous svchost.exe child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Nextron Systems published technical analysis of wskmon.sys on 2026-06-26, describing it as a kernel-resident network backdoor that intercepts inbound TCP traffic and accepts encrypted, HMAC-authenticated commands. The report detailed capabilities including remote shell execution, arbitrary file writing, and shellcode execution from kernel context.
LOLDrivers published an entry for IMFForceDelete.sys, describing how ESET documented the GentleKiller Cleaner variant dropping the vulnerable driver without the .sys extension. The entry ties the abuse to defense impairment through protected-file deletion and includes detection guidance.
LOLDrivers published an entry for 360netmon_wfp.sys, a signed Qihoo/360.cn kernel driver documented by ESET as abused by the GentleKiller Network Blocker variant in Gentlemen ransomware intrusions. The entry recommends blocking the driver and provides detection and hunting resources.
The analyzed wskmon.sys sample was first submitted to VirusTotal from China on 2026-06-15. Nextron's analysis links this WHQL-signed driver to a kernel-resident network backdoor using Windows Filtering Platform stream callouts.
The wskmon.sys kernel driver bore an Authenticode certificate for Shenzhen Aolian Information Security Technology Co., Ltd. with a signing timestamp of 2026-04-17. This signing enabled the malicious driver to appear trusted within Microsoft's driver-signing ecosystem.
The IMFForceDelete.sys driver vulnerability was identified as CVE-2019-6494, allowing low-privileged users to delete files regardless of access controls via IOCTL 0x8016E000. This established the driver as abusable for defense impairment once loaded.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
nextron-systems.com
Open sourceloldrivers.io
Open sourceloldrivers.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Multiple threat actors used malicious but legitimately signed Microsoft kernel drivers in targeted intrusions across telecommunications, BPO, MSSP, financial, and other sectors, according to SentinelOne. The toolkit combined the **STONESTOP** userland component with the **POORTRY** kernel driver to evade defenses by terminating, suspending, and resuming antivirus and EDR processes; later variants also added file deletion and overwrite functions. SentinelOne identified three versions of the toolkit, including two signed through Microsoft’s **WHQL** process, indicating that attackers were able to weaponize trusted driver signing to operate at the kernel level while undermining endpoint protections. SentinelOne said it first reported the issue to Microsoft’s Security Response Center in October 2022 under case `75361`, after which Microsoft published advisory `ADV220005`. The company also linked similar signed-driver abuse to a separate intrusion that ended with **Hive ransomware** deployment in the medical sector. Based on repeated use by distinct intruders, SentinelOne assessed with high confidence that the drivers were likely supplied through a service model, enabling multiple actors to buy or obtain signed kernel tools specifically built to neutralize security software during attacks.
Jun 29, 2026
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026