Loading story…
Researchers reported a Silver Fox campaign using fake software installers, including a sample named NVIDIA.exe, to deploy a vulnerable or malicious signed kernel driver and shut down endpoint protection on Windows systems. The installer drops a 25,056-byte driver as a randomly named file in a temporary directory, registers it as a kernel service, enables SeLoadDriverPrivilege, and loads it through NtLoadDriver. Once active, the driver exposes the \\.\NSecKrnl device and accepts IOCTL 0x2248E0 requests to terminate processes from a hardcoded list of security tools, with Chinese products such as 360 Antivirus specifically targeted.
The driver, NSecKrnl64, was reportedly signed by Shandong Anzai Information Technology CO., Ltd. and implements process termination through Windows kernel routines including PsLookupProcessByProcessId, ObOpenObjectByPointer, and ZwTerminateProcess. The activity aligns with bring your own vulnerable driver (BYOVD) tradecraft, where signed drivers are abused to bypass or disable defenses. Microsoft’s recommended driver block rules provide a relevant mitigation path, while defenders were urged to monitor driver and service installation from user-writable temp paths, registry changes under HKLM\SYSTEM\CurrentControlSet\Services, and subsequent kernel driver loads tied to suspicious installers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers identified a new Silver Fox campaign distributing fake application installers such as WinRAR and Telegram. The campaign used a sample named NVIDIA.exe to deploy a kernel driver and disable endpoint security products, with targeting that strongly suggests Chinese victims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors in multiple intrusions abused **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections from kernel mode after gaining access through phishing or compromised remote-access credentials. Huntress reported an intrusion that began with stolen **SonicWall SSLVPN** credentials and escalated into deployment of an EDR killer built around a legitimate **EnCase** forensic driver, which Windows loaded despite the driver’s expired and revoked certificate. The malware hid the embedded driver with a 256-word substitution scheme, installed it as a kernel service with OEM-like naming, and repeatedly terminated a hashed list of **59** security processes before responders disrupted the attack ahead of ransomware deployment. Separate research tied similar tradecraft to **SilverFox**, which used vulnerable or signed drivers including **BootRepair.sys**, **EnPortv.sys**, **wsftprm.sys**, and a Microsoft-signed **WatchDog Antimalware** driver derived from the Zemana SDK to kill protected security processes and deliver **ValleyRAT/Winos**. Cato documented a campaign against a Japanese industrial manufacturer that used invoice-themed phishing, abused **QQ** and **Tencent Cloud** for delivery, and sideloaded a malicious `PDFCORE8.dll` through legitimate **ConvertToPDF.exe** and **PDFDirect.exe`; Check Point found SilverFox also adapted quickly to blocklists by modifying a single byte in an unauthenticated Authenticode timestamp area, preserving a valid Microsoft signature while changing the file hash. The combined reporting shows attackers increasingly pairing initial access with signed-driver abuse, DLL sideloading, and stealthy loaders to neutralize EDR before establishing persistent remote access.
Jul 31, 2026
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026