ABYSSWORKER

ABYSSWORKER is a malicious Windows kernel driver used primarily for defense evasion in ransomware intrusions. It is associated most prominently with Medusa operations and has also been observed in DragonForce activity and in commercially sold EDR-killer tooling such as AbyssKiller. The driver is commonly described as a custom-built, signed kernel component that masquerades as legitimate security software drivers, including Palo Alto Networks and CrowdStrike-related products, in order to blend into enterprise environments while operating with kernel privileges.

Its core purpose is to disable or degrade endpoint protection products before or during ransomware deployment. Reported functionality includes terminating protected security processes and threads, stripping or denying handles to protected malware client processes, removing or tampering with kernel notification callbacks, detaching mini-filters, replacing driver dispatch routines to break security tooling, restoring selected hooked kernel routines, performing file operations, and rebooting the system. These behaviors place it squarely in the class of kernel-level EDR killers and rootkit-like defensive bypass tools.

ABYSSWORKER has been used alongside bring-your-own-vulnerable-driver tradecraft and is frequently discussed in the same operational context as vulnerable process-killer drivers. In some campaigns it was installed by a loader packed with HeartCrypt, and multiple observed samples were signed with revoked or likely stolen certificates. Reporting also links the driver family to the earlier POORTRY designation, and some intrusion reporting uses Abyssworker and Poortry interchangeably.

The malware targets Windows systems and is intended for privileged execution as a kernel service on modern desktop and server environments. Its role in ransomware operations is typically pre-encryption or concurrent defense suppression, enabling operators to silence EDR and antivirus products, preserve access, and improve the reliability of subsequent payloads such as data theft tools, remote access implants, and ransomware encryptors.