Loading story…
RobbinHood ransomware operators used a legitimate but vulnerable Gigabyte kernel driver, GDRV.SYS, to disable Windows driver signature enforcement and load an unsigned malicious driver, RBNL.SYS, before encrypting victim systems. The attack abused CVE-2018-19320 / CORE-2018-0007, an arbitrary kernel memory read/write flaw in the signed driver, giving the attackers kernel-level access through a bring-your-own-vulnerable-driver technique.
Sophos said the intrusion chain centered on STEEL.EXE, which deployed ROBNR.EXE, GDRV.SYS, RBNL.SYS, and a PLIST.TXT file containing security products to target. Once loaded, the malicious driver deleted security software files and terminated antivirus and other defensive processes from kernel space, bypassing tamper protections on Windows 7, 8, and 10 and clearing the way for ransomware execution.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Sophos disclosed the attack chain involving STEEL.EXE, ROBNR.EXE, GDRV.SYS, RBNL.SYS, and PLIST.TXT, explaining how the attackers disabled Windows driver signature enforcement and deleted security software from kernel space. The company also published SHA-256 indicators for multiple components used in the attacks.
The Gigabyte GDRV.SYS driver vulnerability later abused by RobbinHood attackers had already been publicly disclosed years earlier as CORE-2018-0007 / CVE-2018-19320, enabling arbitrary kernel memory read and write.
Sophos analyzed two RobbinHood ransomware incidents in which attackers used Gigabyte's signed but vulnerable GDRV.SYS driver to disable driver signature enforcement, load the unsigned RBNL.SYS driver, and kill security tools before encryption. Sophos said this was the first time it had observed ransomware using a trusted third-party signed driver to patch the Windows kernel in memory and neutralize endpoint defenses from kernel mode.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
The **Hyadina** ransomware operation has deployed its newly rebranded **GodDamn** locker against U.S. organizations, using a signed kernel driver called **PoisonX** to weaken endpoint protections before encryption. Symantec linked GodDamn to the earlier **Beast** and **Monster** ransomware families, describing it as the latest rebrand in the same lineage. In the investigated intrusion, the attackers used **AnyDesk** for remote access, **PsExec** for lateral movement, and a broad credential-theft toolkit built around **Mimikatz** and multiple **NirSoft** utilities, while also using a fake Symantec-branded evasion tool to install the malicious driver. PoisonX, signed through Microsoft’s Hardware Compatibility process, was used in a **bring your own vulnerable driver**-style tactic to terminate security processes and remove user-mode API hooks, reducing the effectiveness of endpoint defenses. Symantec said the attackers established persistence and unattended remote access across at least 10 hosts before ransomware binaries were detected, with suspicious AnyDesk activity preceding lateral movement and final deployment by several days. Researchers said the case shows Hyadina’s increasing reliance on dual-use and open-source tools, while also underscoring concerns that Microsoft’s vulnerable driver blocklist may not immediately cover newly identified malicious or dangerous drivers.
Aug 11, 2026
Microsoft and multiple security firms reported that **Raspberry Robin** evolved from a USB-spreading worm into a broader malware delivery platform used to stage ransomware intrusions. The malware typically arrives through infected removable media or shared files containing malicious `.LNK` shortcuts, then abuses legitimate Windows tools such as `cmd.exe`, `msiexec.exe`, `rundll32.exe`, `regsvr32.exe`, and `fodhelper.exe` to download and launch payloads while evading detection. Researchers tied its infrastructure to short algorithmic domains, HTTP over port `8080`, compromised **QNAP** and other IoT devices, and Tor-based command-and-control, while also documenting heavy obfuscation, sandbox evasion, persistence in `ProgramData` and similar paths, and privilege-escalation techniques including UAC bypasses. Follow-on activity linked Raspberry Robin infections to payloads including **FakeUpdates/SocGholish, IcedID, Bumblebee, Truebot, Fauppod, Grace, and Cobalt Strike**, with Microsoft saying the access was later used in **Clop** ransomware attacks and showed overlaps with **FIN11/TA505** and possible **Evil Corp** pre-ransomware behavior. Victims spanned government, telecommunications, finance, manufacturing, retail, education, transportation, and industrial sectors across Europe, Latin America, Australia, and elsewhere, underscoring its role in a criminal ecosystem where initial access is likely brokered to other operators for data theft, reconnaissance, and ransomware deployment.
Aug 15, 2026