Loading story…
Researchers disclosed a local privilege escalation flaw in the signed Windows driver bandainamcoonline.sys, which was installed with Mobile Suit Gundam Online via GundamOnline.exe. The driver exposed IOCTL handlers that could disable SMEP and execute attacker-supplied code from user space in kernel mode, allowing any local user to run arbitrary Ring 0 code and gain full system privileges.
Analysis found the vulnerable driver was nearly identical to Capcom’s previously abused capcom.sys, indicating both likely originated from the same anti-cheat code base. The issue was uncovered after sandbox heuristics flagged supervisor-mode execution of user-space memory, and BANDAI NAMCO Online reportedly released a patch within three days that removed the vulnerable driver from the game.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers found the earliest sample of the signed Windows driver bandainamcoonline.sys in November 2015. They assessed it likely predated Capcom's similar vulnerable driver by nearly a year.
BANDAI NAMCO Online responded to Kaspersky's report and released a patch three days later. The update removed the vulnerable driver so it was no longer loaded by the game executable.
After confirming the issue, Kaspersky notified BANDAI NAMCO Online Inc. about the local privilege escalation vulnerability in bandainamcoonline.sys. The notification concerned the driver's ability to let local users execute arbitrary code with kernel privileges.
Kaspersky researchers analyzed GundamOnline.exe and found that its signed driver, bandainamcoonline.sys, exposed IOCTL functionality that disabled SMEP and executed attacker-supplied user-space code in kernel mode. The flaw allowed any local user to gain arbitrary Ring 0 code execution and elevate privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two signed Windows kernel drivers that can be abused in **bring-your-own-vulnerable-driver (BYOVD)** attacks to gain elevated privileges and bypass platform protections. Motorola's `SmSerl64.sys` from the SM56 Modem WDM Driver package (`6.12.23.0`) was reported as vulnerable to crafted `IOCTL` requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as **`CVE-2024-55414`**. Separately, Patrick Saif reported that `ComputerZ_x64.sys`, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted `MSR` reads that can defeat `KASLR`, weakly filtered port I/O, and unrestricted PCI configuration writes. Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's `HVCI` blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block `SmSerl64.sys` across endpoints and use published **YARA** and **Sigma** detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading `IA32_LSTAR`, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Jun 29, 2026
Microsoft disclosed **CVE-2026-25179**, an **elevation of privilege** vulnerability in the **Windows Ancillary Function Driver for WinSock** (`afd.sys`), the kernel component that supports Windows socket operations. The issue was published through Microsoft's Security Update Guide and affects a privileged part of the Windows networking stack, meaning successful exploitation could allow an attacker to gain higher permissions on a targeted system. The newly listed flaw aligns with Microsoft's earlier disclosure of **CVE-2023-35632**, which affected the same **Windows Ancillary Function Driver for WinSock** component and was also classified as an elevation of privilege bug. The repeated appearance of privilege-escalation vulnerabilities in `afd.sys` highlights continued security risk around this Windows driver and reinforces the need for organizations to prioritize Microsoft security updates for systems exposed to local compromise or post-exploitation activity.
Jul 12, 2026
A ransomware actor abused the legitimate `mhyprot2.sys` anti-cheat driver from the game **Genshin Impact** to terminate antivirus and endpoint protection processes before encrypting systems. Trend Micro reported that the attacker dropped and installed the signed driver, then used it to kill security tools by exploiting the driver's kernel-level privileges, allowing the intrusion to proceed with reduced detection and resistance. The technique highlights a **bring-your-own-vulnerable-driver** style tradecraft in which trusted or signed drivers are repurposed to bypass defenses and gain powerful access on Windows endpoints. By weaponizing a legitimate game anti-cheat component rather than custom malware alone, the actor was able to undermine security products and improve the chances of successful ransomware deployment, underscoring the need for driver blocklists, application control, and monitoring for unexpected driver installation on enterprise systems.
Sep 3, 2026