Loading story…
Researchers disclosed Bring Your Own Trusted Caller (BYOTC), a Windows attack pattern that compromises or manipulates a legitimate signed user-mode application to invoke privileged operations through its associated kernel driver. Unlike Bring Your Own Vulnerable Driver (BYOVD), BYOTC does not require a driver flaw: it exploits a driver's trust in an approved caller as a confused-deputy condition, enabling actions such as process termination and security-tool tampering. One proof of concept injected a DLL into Malwarebytes' MBAM.exe and used mbamchameleon.sys to terminate Microsoft Defender's MsMpEng.exe process.
A separate proof of concept targeted System Informer's trust-chain design, using privileged handles retained during process creation to alter a verified process and spawn a child process with MAXIMUM trust. System Informer released signed-driver changes to remediate that weakness. The technique is significant because Windows protected anti-malware services are designed to resist tampering, injection, and memory modification by unprotected—even administrative—processes; BYOTC instead seeks to operate through software and driver relationships already treated as trusted.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
System Informer released an updated signed driver to its Release Channel, requiring a MAXIMUM creator or protected Windows TCB/System process at the root of a trusted chain. It also changed its restart path to use a temporary service, preventing ordinary administrators from retaining the privileged creator handle.
Researchers described the Bring Your Own Trusted Caller (BYOTC) technique, in which attacker-controlled code inside a signed client invokes privileged driver functions. Proofs of concept included injecting a DLL into MBAM.exe to use mbamchameleon.sys to terminate Microsoft Defender's MsMpEng.exe, and abusing System Informer's trust chain to create a child process with MAXIMUM trust.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcexusheng.dev
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors in multiple intrusions abused **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections from kernel mode after gaining access through phishing or compromised remote-access credentials. Huntress reported an intrusion that began with stolen **SonicWall SSLVPN** credentials and escalated into deployment of an EDR killer built around a legitimate **EnCase** forensic driver, which Windows loaded despite the driver’s expired and revoked certificate. The malware hid the embedded driver with a 256-word substitution scheme, installed it as a kernel service with OEM-like naming, and repeatedly terminated a hashed list of **59** security processes before responders disrupted the attack ahead of ransomware deployment. Separate research tied similar tradecraft to **SilverFox**, which used vulnerable or signed drivers including **BootRepair.sys**, **EnPortv.sys**, **wsftprm.sys**, and a Microsoft-signed **WatchDog Antimalware** driver derived from the Zemana SDK to kill protected security processes and deliver **ValleyRAT/Winos**. Cato documented a campaign against a Japanese industrial manufacturer that used invoice-themed phishing, abused **QQ** and **Tencent Cloud** for delivery, and sideloaded a malicious `PDFCORE8.dll` through legitimate **ConvertToPDF.exe** and **PDFDirect.exe`; Check Point found SilverFox also adapted quickly to blocklists by modifying a single byte in an unauthenticated Authenticode timestamp area, preserving a valid Microsoft signature while changing the file hash. The combined reporting shows attackers increasingly pairing initial access with signed-driver abuse, DLL sideloading, and stealthy loaders to neutralize EDR before establishing persistent remote access.
Jul 31, 2026
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, **`BTR.sys`**, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and **`SeLoadDriverPrivilege`** to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its **RC4-encrypted** format and **`:changelist`** alternate data stream, and released the **`BTR_CLI`** proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2. The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as **`WdFilter.sys`** and **`MsMpEng.exe`**, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring **ADS `:changelist` creation**, unusual **`BTR.sys`** loads, suspicious service staging, **`BootClean.log`** artifacts, and tighter control of **`SeLoadDriverPrivilege`**.
Aug 26, 2026
Researchers disclosed two signed Windows kernel drivers that can be abused in **bring-your-own-vulnerable-driver (BYOVD)** attacks to gain elevated privileges and bypass platform protections. Motorola's `SmSerl64.sys` from the SM56 Modem WDM Driver package (`6.12.23.0`) was reported as vulnerable to crafted `IOCTL` requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as **`CVE-2024-55414`**. Separately, Patrick Saif reported that `ComputerZ_x64.sys`, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted `MSR` reads that can defeat `KASLR`, weakly filtered port I/O, and unrestricted PCI configuration writes. Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's `HVCI` blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block `SmSerl64.sys` across endpoints and use published **YARA** and **Sigma** detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading `IA32_LSTAR`, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Jun 29, 2026