Loading story…
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, BTR.sys, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and SeLoadDriverPrivilege to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its RC4-encrypted format and :changelist alternate data stream, and released the BTR_CLI proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2.
The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as WdFilter.sys and MsMpEng.exe, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring ADS :changelist creation, unusual BTR.sys loads, suspicious service staging, BootClean.log artifacts, and tighter control of SeLoadDriverPrivilege.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published reverse-engineering research showing how Windows Defender's BTR.sys can be repurposed as a signed kernel-mode primitive for arbitrary file and registry operations. The report documented the RC4-encrypted transaction format, identified six supported action IDs, and said no in-the-wild abuse had been observed.
A public GitHub repository for BTR_CLI described an offensive proof-of-concept that weaponizes Microsoft's signed BTR.sys remediation driver. The repository included details on runtime and boot-time execution, anti-forensics, and Defender component removal demonstrations.
The BTR_CLI documentation states the technique was confirmed operational from Windows 7 through Windows 11 25H2. It anchors that validation as current as July 2026.
The BTR.sys abuse technique was reported to Microsoft's Security Response Center, according to the BTR_CLI project documentation. The report said the technique requires administrator rights and SeLoadDriverPrivilege.
Check Point researcher Jiří Vinopal presented the BTR Reforged technique in Las Vegas at Black Hat USA 2026 and DEF CON 34. The talks publicly demonstrated how Microsoft's signed BTR.sys remediation driver could be abused for arbitrary kernel-level file and registry operations.
Microsoft's Security Response Center determined the BTR.sys findings did not meet criteria for immediate servicing because the technique requires pre-existing administrative privileges, including SeLoadDriverPrivilege. The project documentation says no patch is planned.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
13 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecsoonline.com
Open sourceheise.de
Open sourcemkd-cirt.mk
Open sourceresearch.checkpoint.com
Open sourcegithub.com
Open sourcelearn.microsoft.com
Open sourceloldrivers.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026
Fortinet disclosed two techniques that can let attackers load unsigned kernel drivers on Windows systems by tampering with **Driver Signature Enforcement (DSE)** at runtime, despite protections such as Code Integrity, PatchGuard, Virtualization-based Security, and Microsoft’s recommended vulnerable-driver block rules. The methods, dubbed **Page Swapping** and **Callback Swapping**, abuse kernel write access—often obtained through vulnerable third-party drivers—to redirect protected Code Integrity policy data or replace validation callbacks in `ntoskrnl.exe`, causing malicious drivers to be accepted as trusted. The report says Microsoft’s **Kernel Data Protection (KDP)** and driver blocklists raise the bar but do not fully stop runtime DSE tampering when **Hypervisor-protected Code Integrity (HVCI)** is not enabled, because driver validation can still be manipulated in the normal kernel. The findings build on a long history of DSE bypass tradecraft, including Turla-linked tooling such as **TDL**, a loader that mapped specially crafted unsigned drivers into kernel memory without modifying standard Code Integrity variables, underscoring how kernel-level access and vulnerable drivers remain a practical path to stealthy persistence and defense evasion on Windows.
Aug 15, 2026
Kaspersky detailed a Windows design flaw that allowed attackers to achieve boot-time kernel shellcode persistence on fully updated **Windows 7** and **Windows Server 2008 R2** by abusing insecure handling of registry data in legacy graphics drivers. The issue stems from use of `RtlQueryRegistryValues` with `RTL_QUERY_REGISTRY_DIRECT` and weak type validation, letting oversized `REG_BINARY` or `REG_SZ` values trigger stack buffer overflows where `REG_DWORD` data was expected in drivers including `dxgmms1.sys` and `dxgkrnl.sys`. Kaspersky said the weakness was tied to an incomplete fix for **CVE-2010-4398**, had been known for years, and was seen in a targeted attack in 2018, while Microsoft did not pursue further remediation because exploitation required administrator privileges. The attack chain used malicious values under `GraphicsDrivers` and `GraphicsDrivers\MemoryManager` to write shellcode to kernel memory at `0xfffff78000000800` and redirect execution there during boot. Kaspersky’s analysis of the recovered payload showed a second stage that injected into `vboxtray.exe`, loaded a reflective DLL named `keylogger.dll`, captured keystrokes with a `WH_KEYBOARD_LL` hook, encrypted the data with **RC4** using a key derived from the system `MachineGuid`, and exfiltrated the logs over **UDP port 53**. The company published the findings as part of a SAS CTF challenge walkthrough that reconstructed the full intrusion path from registry-based kernel persistence to user-mode keylogging and network exfiltration.
Jun 29, 2026