Loading story…
Researchers documented multiple espionage malware families using vulnerable but legitimately signed Oracle VirtualBox drivers to defeat Windows kernel protections and load unsigned code. Uroburos, a rootkit associated with Turla, was reported to disable Driver Signature Enforcement by installing VBoxDrv.sys and exploiting flaws in the driver, while also using stealth features such as hidden kernel modules, overwritten in-memory PE headers, RWX mappings, covert HTTP header command parsing, and direct responses to specially crafted network requests before traffic reached userland. Analysts said the technique exposed a broader weakness in code-signing and certificate revocation because old signed drivers can remain trusted long after release.
A separate toolkit, AcidBox, used a similar exploit chain against a newer signed VirtualBox driver, VBoxDrv.sys version 2.2.0, to load an unsigned kernel payload during targeted intrusions against Russian organizations. Unit 42 reported that AcidBox persisted through the Security Support Provider mechanism to load into lsass.exe, decrypted worker modules from the Windows registry, and concealed payloads in encrypted, compressed data appended to icon resources. Other Turla-linked research in the same body of reporting described increasingly advanced kernel and firmware tradecraft, including the MoonBounce UEFI implant and a Turla-attributed keylogger, underscoring a sustained focus on stealthy boot- and kernel-level persistence in high-end espionage operations.
TTPs, infrastructure, and targeting history in one profile.
18 events from the most recent confirmed update back to the earliest known activity.
EpicTurla published analysis noting apparent code overlap between an ACIDBOX DLL and a Turla Nautilus payload, initially suggesting the shared crypto implementation warranted further attention.
Unit 42 published a report describing AcidBox as a rare modular malware toolkit used in targeted attacks in 2017, detailing its reuse of a Turla-associated VirtualBox exploit chain and its SSP-based persistence in lsass.exe.
0ffset published static analysis of a 64-bit DLL keylogger attributed to Turla, documenting its XOR-based string decryption and recovered strings including "msimm.dat" and "KSL0T Ver = 21.0."
Unit 42 says it discovered an AcidBox sample on VirusTotal in February 2019 containing a string associated with Turla's VirtualBox exploit, leading researchers to assess it as a previously unknown malware family.
EpicTurla notes that the Turla Nautilus sample used for later code-overlap comparison had been reported by NCSC in November 2017.
Unit 42 says Kaspersky found an additional AcidBox sample in its databases that appeared in June 2017, supporting the campaign timeframe.
Unit 42 reports that all known AcidBox samples shared compilation timestamps of May 9, 2017, indicating the toolkit was built for the 2017 activity cluster.
ExaTrack analyzed a 2017 Uroburos/Turla rootkit sample that targeted servers, retained the Null-driver and VirtualBox exploit traits from 2014, and changed its network protocol while dropping the earlier PatchGuard bypass.
Unit 42 reports that an unknown actor used AcidBox with VBoxDrv.sys v2.2.0 to target at least two Russian organizations in 2017, and Dr.Web linked it to a targeted attack on an unspecified Russian entity that year.
Kaspersky's MoonBounce analysis says the patched rogue CORE_DXE firmware component carried a reported link time of 2014-07-18 03:29:55 UTC.
Unit 42 says that in 2014 Turla's kernel-mode malware was publicly described as the first case of abusing a third-party signed device driver, VBoxDrv.sys v1.6.2, to disable Windows Driver Signature Enforcement and load unsigned payloads.
ExaTrack says Uroburos was originally detected in 2014 and was notable for using a 64-bit Windows rootkit driver.
Unit 42 states that Core Security found CVE-2008-3431 in 2008, affecting VBoxDrv.sys versions less than or equal to 1.6.2.
G Data published analysis describing how Uroburos used a legitimately signed Oracle VirtualBox driver and a vulnerability in it to disable Driver Signature Enforcement, alongside a Kernel Patch Protection bypass, calling it the first observed in-the-wild combination of those techniques.
Kaspersky published technical details on MoonBounce, describing a UEFI firmware implant in a rogue CORE_DXE component that hooks boot services, tampers with the Windows loader and kernel, and injects a user-mode stager into svchost.exe.
EpicTurla updated the ACIDBOX post on 2020-06-29 to say the observed overlap was not unique and was actually Mbed TLS compiled with Visual Studio, explicitly retracting the earlier implication of a meaningful Turla link.
EpicTurla says Palo Alto Unit 42 researchers Dominik Reichel and Esmid Idrizovic disclosed ACIDBOX, also known as KL: MagicScroll, as a new activity set and described it as reminiscent of Remsec while stopping short of firm attribution.
Unit 42 reports that Oracle fixed CVE-2008-3431 in VBoxDrv.sys version 1.6.4 by changing how VBoxDrvNtDeviceControl handled the UserBuffer pointer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
epicturla.com
Open sourceunit42.paloaltonetworks.com
Open source0ffset.net
Open sourcegdatasoftware.com
Open sourcesecurelist.com
Open sourcemedia.kasperskycontenthub.com
Open sourceexatrack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors in multiple intrusions abused **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections from kernel mode after gaining access through phishing or compromised remote-access credentials. Huntress reported an intrusion that began with stolen **SonicWall SSLVPN** credentials and escalated into deployment of an EDR killer built around a legitimate **EnCase** forensic driver, which Windows loaded despite the driver’s expired and revoked certificate. The malware hid the embedded driver with a 256-word substitution scheme, installed it as a kernel service with OEM-like naming, and repeatedly terminated a hashed list of **59** security processes before responders disrupted the attack ahead of ransomware deployment. Separate research tied similar tradecraft to **SilverFox**, which used vulnerable or signed drivers including **BootRepair.sys**, **EnPortv.sys**, **wsftprm.sys**, and a Microsoft-signed **WatchDog Antimalware** driver derived from the Zemana SDK to kill protected security processes and deliver **ValleyRAT/Winos**. Cato documented a campaign against a Japanese industrial manufacturer that used invoice-themed phishing, abused **QQ** and **Tencent Cloud** for delivery, and sideloaded a malicious `PDFCORE8.dll` through legitimate **ConvertToPDF.exe** and **PDFDirect.exe`; Check Point found SilverFox also adapted quickly to blocklists by modifying a single byte in an unauthenticated Authenticode timestamp area, preserving a valid Microsoft signature while changing the file hash. The combined reporting shows attackers increasingly pairing initial access with signed-driver abuse, DLL sideloading, and stealthy loaders to neutralize EDR before establishing persistent remote access.
Jul 31, 2026
Kaspersky detailed a Windows design flaw that allowed attackers to achieve boot-time kernel shellcode persistence on fully updated **Windows 7** and **Windows Server 2008 R2** by abusing insecure handling of registry data in legacy graphics drivers. The issue stems from use of `RtlQueryRegistryValues` with `RTL_QUERY_REGISTRY_DIRECT` and weak type validation, letting oversized `REG_BINARY` or `REG_SZ` values trigger stack buffer overflows where `REG_DWORD` data was expected in drivers including `dxgmms1.sys` and `dxgkrnl.sys`. Kaspersky said the weakness was tied to an incomplete fix for **CVE-2010-4398**, had been known for years, and was seen in a targeted attack in 2018, while Microsoft did not pursue further remediation because exploitation required administrator privileges. The attack chain used malicious values under `GraphicsDrivers` and `GraphicsDrivers\MemoryManager` to write shellcode to kernel memory at `0xfffff78000000800` and redirect execution there during boot. Kaspersky’s analysis of the recovered payload showed a second stage that injected into `vboxtray.exe`, loaded a reflective DLL named `keylogger.dll`, captured keystrokes with a `WH_KEYBOARD_LL` hook, encrypted the data with **RC4** using a key derived from the system `MachineGuid`, and exfiltrated the logs over **UDP port 53**. The company published the findings as part of a SAS CTF challenge walkthrough that reconstructed the full intrusion path from registry-based kernel persistence to user-mode keylogging and network exfiltration.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026