Loading story…
Microsoft confirmed that attackers submitted a malicious Windows driver through its signing process, causing the company to certify malware later identified as Netfilter by G DATA and Retliften by Microsoft. The signed driver functioned as a rootkit, giving it the appearance of legitimacy and allowing it to bypass normal Windows driver-signing protections. Microsoft said the activity was limited in scope, was not linked to a nation-state actor, and required either administrative privileges or user assistance to install on a target system.
Researchers reported the driver was used primarily in gaming-related activity in China, where it could spoof geolocation, support cheating, and potentially facilitate account theft. The malware was also capable of installing certificates and intercepting encrypted network traffic, enabling SSL/TLS decryption and broad spying on infected users. Microsoft said it suspended the developer account involved and added detections in Microsoft Defender while publishing mitigation guidance for malicious drivers.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
G Data published technical analysis of the malware it named Netfilter, describing a Microsoft-signed rootkit used in gaming contexts that could enable traffic interception and account compromise.
Microsoft disclosed that malicious drivers had been submitted through the Windows Hardware Compatibility Program and said the activity was limited, primarily affecting gaming environments in China. The company said it suspended the submitting account, reviewed related submissions, and added Defender detections.
On June 17, researcher Karsten Hahn discovered that Microsoft had signed a malicious Windows rootkit driver later called Netfilter. The driver could intercept traffic and install certificates to decrypt SSL/TLS communications on infected systems.
G Data researchers found older samples of the Netfilter malware dating back to March 2021, indicating the malicious driver campaign was active by then.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
vice.com
Open sourcegdatasoftware.com
Open sourcemsrc-blog.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026
Multiple threat actors used malicious but legitimately signed Microsoft kernel drivers in targeted intrusions across telecommunications, BPO, MSSP, financial, and other sectors, according to SentinelOne. The toolkit combined the **STONESTOP** userland component with the **POORTRY** kernel driver to evade defenses by terminating, suspending, and resuming antivirus and EDR processes; later variants also added file deletion and overwrite functions. SentinelOne identified three versions of the toolkit, including two signed through Microsoft’s **WHQL** process, indicating that attackers were able to weaponize trusted driver signing to operate at the kernel level while undermining endpoint protections. SentinelOne said it first reported the issue to Microsoft’s Security Response Center in October 2022 under case `75361`, after which Microsoft published advisory `ADV220005`. The company also linked similar signed-driver abuse to a separate intrusion that ended with **Hive ransomware** deployment in the medical sector. Based on repeated use by distinct intruders, SentinelOne assessed with high confidence that the drivers were likely supplied through a service model, enabling multiple actors to buy or obtain signed kernel tools specifically built to neutralize security software during attacks.
Jun 29, 2026
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026