Loading story…
Researchers identified PlugPlayService.sys, a heavily obfuscated 64-bit Windows kernel driver that provides arbitrary kernel-memory access, shellcode execution, physical-memory mapping, system-thread creation, and direct access to RAID devices. The driver is signed with a Microsoft Windows Hardware Compatibility Publisher certificate, potentially allowing it to appear legitimate while delivering capabilities associated with a kernel-level backdoor.
A related driver, neonddu.sys, contains byte-identical PE sections and the same Authentihash, although its embedded signature does not validate cryptographically; the valid WHQL-signing observation applies only to PlugPlayService.sys. Analysts also observed code-obfuscation similarities to the RegPhantom backdoor and reporting on similar drivers used by xigmapper, but neither observation establishes attribution for this sample.
Pull IOCs and campaign context straight into your stack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026
Researchers disclosed two signed Windows kernel drivers that can be abused in **bring-your-own-vulnerable-driver (BYOVD)** attacks to gain elevated privileges and bypass platform protections. Motorola's `SmSerl64.sys` from the SM56 Modem WDM Driver package (`6.12.23.0`) was reported as vulnerable to crafted `IOCTL` requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as **`CVE-2024-55414`**. Separately, Patrick Saif reported that `ComputerZ_x64.sys`, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted `MSR` reads that can defeat `KASLR`, weakly filtered port I/O, and unrestricted PCI configuration writes. Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's `HVCI` blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block `SmSerl64.sys` across endpoints and use published **YARA** and **Sigma** detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading `IA32_LSTAR`, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Jun 29, 2026
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, **`BTR.sys`**, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and **`SeLoadDriverPrivilege`** to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its **RC4-encrypted** format and **`:changelist`** alternate data stream, and released the **`BTR_CLI`** proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2. The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as **`WdFilter.sys`** and **`MsMpEng.exe`**, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring **ADS `:changelist` creation**, unusual **`BTR.sys`** loads, suspicious service staging, **`BootClean.log`** artifacts, and tighter control of **`SeLoadDriverPrivilege`**.
Aug 26, 2026