Loading story…
Researchers reported that PoorTry—also tracked as BurntCigar—has evolved from a signed Windows kernel driver used to disable endpoint protections into a more destructive EDR wiper that deletes security software files before ransomware is deployed. Sophos observed the upgraded tool in a RansomHub intrusion, where attackers used a user-mode component to identify endpoint security files and a kernel-mode component to terminate protected processes and remove critical EXE, DLL, and related files, preventing security products from recovering before encryption began.
The newer variants show increasingly evasive tradecraft associated with signed malicious drivers in ransomware operations. Reporting indicates the malware uses hardcoded paths as well as deletion by filename or file type, while operators rotate among differently signed payloads and manipulate signature timestamps in a "certificate roulette" approach to improve execution success. The activity reflects a broader pattern seen in ransomware campaigns, including earlier use of signed kernel drivers by groups such as BlackCat/ALPHV, to neutralize defenses at the kernel level and give attackers a clearer path to encrypt victim systems.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
During a July 2024 RansomHub attack, attackers used PoorTry to delete critical EXE, DLL, and other files belonging to security software before ransomware encryption. Sophos said this prevented EDR products from being recovered or restarted during the attack.
In May 2023, Trend Micro warned that PoorTry had file-deletion functionality, marking an early public report of the malware's ability to go beyond process termination. This indicated the tool was expanding toward more destructive anti-security behavior.
During 2022 and 2023, PoorTry variants evolved through code optimization and obfuscation. Researchers also observed the malware and its loader Stonestop being packed with VMProtect, Themida, and ASMGuard for evasion.
PoorTry, also known as BurntCigar, was developed in 2021 as a malicious Windows kernel-mode driver designed to disable EDR and other security software. It later became associated with use by multiple ransomware groups.
Sophos published research describing how BurntCigar/PoorTry had evolved into a full-featured EDR wiper that terminates security processes and deletes critical files. The report also described newer variants using signature timestamp manipulation, borrowed software metadata, and multiple signed payloads in a 'certificate roulette' tactic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 175 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcenews.sophos.com
Open sourcecloud.google.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that new variants of the **Poortry** malicious kernel driver and its **Stonestop** loader have evolved into a more destructive tool used to disable security defenses during ransomware attacks. Previously known for terminating processes, the latest samples can patch kernel callbacks, interfere with filter drivers, kill security processes, and delete critical EDR files from disk, effectively shifting Poortry from an EDR killer to an **EDR wiper**. Researchers said the malware continues to develop even after Microsoft closed the attestation-signing loophole that earlier versions abused. The toolset has been linked to major ransomware operations including **CUBA, BlackCat, Medusa, LockBit, and RansomHub**, where it is used to clear the way for encryption by impairing endpoint protection. Sophos observed attackers switching rapidly between differently signed Poortry variants during intrusions, suggesting access to multiple stolen or leaked certificates and an adaptive evasion strategy. In one RansomHub-related intrusion, Poortry and Stonestop were deployed before ransomware execution, reinforcing assessments that the driver now functions as a rootkit-like sabotage platform for pre-ransomware defense evasion.
Jun 29, 2026
Ransomware operators are using **Bring Your Own Vulnerable Driver (BYOVD)** attacks to load legitimately signed but flawed Windows kernel drivers, gain ring-0 access, and terminate security products protected by Protected Process Light (PPL). Reported examples include the WatchDog Antimalware v1.1.100 and `eb` kernel drivers, whose unauthenticated IOCTL interfaces can reportedly be abused to kill protected processes. Qilin's Killer Ultra and RansomHub's EDRKillShifter have used the technique through user-mode launchers that drop, load, and control vulnerable drivers. Defenders should detect the sequence of suspicious driver drops, rapid driver installation or loading, low-prevalence driver hashes, and subsequent termination of endpoint-security processes. Organizations should inventory and baseline deployed drivers, enforce Windows Defender Application Control (WDAC) driver policies, enable Microsoft’s Vulnerable Driver Blocklist and HVCI, maintain EDR tamper protection, and restrict administrative privileges to reduce exposure to known vulnerable drivers, including those catalogued by LOLDrivers.
Sep 28, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026