Loading story…
Elastic Security Labs analyzed ABYSSWORKER, a malicious 64-bit Windows kernel driver deployed in financially motivated MEDUSA ransomware activity to disable or evade endpoint detection and response protections. The driver was delivered with a loader packed by HEARTCRYPT and masqueraded as a CrowdStrike Falcon driver; samples were signed using likely stolen certificates associated with Chinese companies that have since been revoked.
ABYSSWORKER provides extensive kernel-level anti-EDR capabilities, including removing security callbacks, hijacking targeted driver dispatch routines, detaching minifilter devices, and terminating processes and system threads. It can also restore NTFS and PNP dispatch functions and perform file operations, while protecting its malware client from external handle access. Elastic observed samples from August 2024 through February 2025 and released YARA coverage and sample hashes to support detection.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Elastic found approximately a dozen ABYSSWORKER samples on VirusTotal, with the identified first-seen date range extending through February 24, 2025.
A second ABYSSWORKER reference sample with SHA-256 b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505 was first seen on VirusTotal.
A reference ABYSSWORKER sample with SHA-256 6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050 was first seen on VirusTotal.
Elastic identified ABYSSWORKER samples with VirusTotal first-seen dates beginning on August 8, 2024.
Google Cloud Mandiant publicly disclosed the malicious POORTRY driver, which Elastic assesses as the earliest public mention of the ABYSSWORKER driver family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators are using **Bring Your Own Vulnerable Driver (BYOVD)** attacks to load legitimately signed but flawed Windows kernel drivers, gain ring-0 access, and terminate security products protected by Protected Process Light (PPL). Reported examples include the WatchDog Antimalware v1.1.100 and `eb` kernel drivers, whose unauthenticated IOCTL interfaces can reportedly be abused to kill protected processes. Qilin's Killer Ultra and RansomHub's EDRKillShifter have used the technique through user-mode launchers that drop, load, and control vulnerable drivers. Defenders should detect the sequence of suspicious driver drops, rapid driver installation or loading, low-prevalence driver hashes, and subsequent termination of endpoint-security processes. Organizations should inventory and baseline deployed drivers, enforce Windows Defender Application Control (WDAC) driver policies, enable Microsoft’s Vulnerable Driver Blocklist and HVCI, maintain EDR tamper protection, and restrict administrative privileges to reduce exposure to known vulnerable drivers, including those catalogued by LOLDrivers.
Sep 28, 2026
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026