Loading malware…
POORTRY, also known as BurntCigar, is a malicious kernel-mode Windows driver used to disable, impair, and increasingly destroy endpoint security products during intrusions. It is commonly paired with the user-mode loader STONESTOP, which installs the driver and issues commands to it. The toolset is associated with financially motivated intrusion activity and has been observed in operations linked to Scattered Spider/UNC3944 as well as multiple ransomware ecosystems including BlackCat, Cuba, LockBit, Medusa, and RansomHub. Similar driver-and-loader combinations have also been reported in activity involving Hive and other criminal operators, suggesting the capability has been reused across actors.
POORTRY was initially used primarily as an EDR killer, terminating selected security processes such as antivirus and endpoint detection agents to clear the way for follow-on activity. Later variants expanded into a more aggressive EDR wiper role by deleting critical security software components from disk, making recovery or restart of disabled defenses more difficult before ransomware deployment. Reported functionality includes process termination, suspension and resumption in some variants, file deletion and overwrite operations, and tampering with kernel mechanisms used by security products, including callback and filter-related structures. This evolution has made POORTRY a broader sabotage platform rather than a simple process killer.
The malware is notable for abusing Windows driver trust mechanisms to achieve kernel-level execution. Operators have used signed malicious drivers, including drivers obtained through Microsoft attestation signing in earlier campaigns, and later shifted to other signing abuse methods such as leaked or stolen certificates and forged signature timestamps. POORTRY and STONESTOP have also been repeatedly packed and obfuscated with commercial protectors to hinder analysis and detection.
POORTRY is used as a defense-evasion and post-compromise tool rather than a primary initial-access payload. In observed intrusions, it is deployed after attackers have already gained access, often shortly before data theft or ransomware execution, to neutralize endpoint protections and improve the likelihood of successful encryption or other malicious actions. Its use has been documented in sectors including telecommunications, business process outsourcing, financial services, healthcare, and other enterprise environments running Windows endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Scattered Spider is known to exploit CVE-2015-2291 which is a vulnerability in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys) that allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges... Scattered Spider exploited CVE-2015-2291 to deploy a malicious kernel driver in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys). | Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint.
"Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint."
The attackers used the known POORTRY driver... for the purposes of killing security software during this attack
23 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2015-2291 ... allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted ... IOCTL call.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
The threat actors also leverage known system vulnerabilities using “Bring Your Own Vulnerable Driver” (BYOVD) techniques to gain administrative privileges and evade detection from endpoint security products.
The binary is a 64-bit Windows PE driver named smuol.sys, and imitates a legitimate CrowdStrike Falcon driver.
Throughout 2022 and 2023, Poortry continued to evolve, optimizing its code and using obfuscation tools like VMProtect, Themida, and ASMGuard to pack the driver and its loader (Stonestop) for evasion.
Notably, it tries to masquerade by using the same information in its properties sheet as a driver (idmtdi.sys) for a commercially available software... the attackers merely cloned the information from it.
The latest report by Sophos is based on a RansomHub attack in July 2024 that employed Poortry to delete critical executable files (EXEs), dynamic link libraries (DLLs), and other essential components of security software.
Poortry now can also delete critical EDR components completely, instead of simply terminating their processes... The loader contains a list of hardcoded paths pointing at the location where EDR products are installed... and deletes files critical to the EDR agent, such as EXE files or DLL files.
The vulnerable drivers used by Scattered Spider are signed by stolen certificates from well-known authorities, such as Microsoft, NVIDIA, and Global Software LLC, which makes them appear legitimate.
SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions... a threat actor utilizing a Microsoft signed malicious driver to attempt evasion of multiple security products.
Scattered Spider typically exploits vulnerabilities such as CVE-2015-2291 and utilize tools like STONESTOP and POORTRY to terminate security software and evade detection.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
110 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious Windows kernel driver used to terminate selected processes, particularly security and EDR software, to evade detection. It has been signed with a Microsoft Windows Hardware Compatibility Authenticode signature to help bypass trust controls.
A malicious Windows kernel driver used to kill selected processes, especially security and EDR software, to evade detection. The content notes it was signed with a Microsoft Windows Hardware Compatibility Authenticode signature.
Driver used in BYOVD attacks to disarm security tools in conjunction with the Osiris ransomware operation.
BYOVD-associated defense-evasion tool referenced as commonly used by ransomware groups to disable security products prior to encryption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.