Threat reportMalwareTL-2026-0091
BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection
BYOVD EDR Killer Tooling (TL-2026-0091) is a high-severity malware campaign, first published 2026-02-04 and last reviewed 2026-10-21. It is attributed to Scattered Spider with high confidence, references 2 CVEs (CVE-2015-2291, CVE-2018-19320), maps to 28 MITRE ATT&CK techniques (T1003.001, T1014, T1021.002), and is covered by 9 detection rules and 59 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 28MITRE ATT&CK
- Actors
- 4Scattered Spider
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 59Indicators of compromise
Key facts for TL-2026-0091
- Threat ID
- TL-2026-0091
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Scattered Spider, RansomHub, CUBA, LockBit
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- All sectors — technique is sector-agnostic, Healthcare, Financial, Manufacturing, Government, Technology, Telecom, BPO
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 59
- Updates
- 2026-10-21 · revalidated 1× · latest source
How BYOVD EDR Killer Tooling works
BYOVD (Bring Your Own Vulnerable Driver) EDR Killer is a rapidly proliferating defense evasion technique where threat actors load legitimately signed but vulnerable kernel drivers to terminate endpoint detection and response (EDR) and antivirus processes from kernel mode. Multiple documented toolkits exploit this technique: AuKill abuses Sysinternals Process Explorer driver (PROCEXP152.sys), Poortry/Stonestop use Microsoft-signed malicious drivers, EDRKillShifter (RansomHub) dynamically selects from multiple vulnerable drivers, Terminator (Spyboy) uses Zemana Anti-Malware driver (zam64.sys), and SCATTERED SPIDER exploits the Intel Ethernet diagnostics driver (iqvw64.sys/CVE-2015-2291). These tools are deployed as pre-ransomware defense evasion, blinding security products before encryption. The LOLDrivers.io project catalogs 700+ vulnerable/malicious kernel drivers. Microsoft's Vulnerable Driver Blocklist is the primary defense but remains incomplete and not universally enforced.
Bring Your Own Vulnerable Driver (BYOVD) is a kernel-level defense evasion technique that exploits a fundamental architectural weakness in Windows security. Since 64-bit Windows Vista, unsigned kernel-mode drivers cannot run by default. BYOVD circumvents this by loading legitimately signed vulnerable drivers that contain exploitable IOCTL handlers, memory read/write primitives, or process termination capabilities. Once loaded with administrative privileges, these drivers operate at Ring 0 (kernel mode), granting attackers the ability to terminate any userspace process — including EDR agents, antivirus services, and security monitoring tools — from a privilege level those tools cannot defend against.
The technique has become the dominant pre-ransomware defense evasion method, with multiple documented toolkits:
**AuKill (Sophos, April 2023):** Abuses the Sysinternals Process Explorer driver (PROCEXP152.sys) to kill security processes. The legitimate Process Explorer driver is signed by Microsoft and provides kernel-level process management. AuKill drops the driver, loads it as a service, then uses its IOCTL interface to terminate a target list of 50+ EDR/AV processes. Observed in Medusa Locker and LockBit ransomware deployments.
**Poortry/Stonestop (Microsoft/Mandiant, 2022-2023):** A malicious kernel driver (Poortry) paired with a userspace loader (Stonestop). The most notable variant used drivers signed with legitimate Microsoft Windows Hardware Compatibility Program (WHCP) certificates — meaning the malicious driver was actually signed by Microsoft's own infrastructure. This represented a catastrophic failure of the code-signing trust model. Used by UNC3944/SCATTERED SPIDER and CUBA ransomware affiliates.
**EDRKillShifter (Sophos, August 2024):** Associated with RansomHub affiliates. A loader-based architecture that dynamically selects from multiple vulnerable drivers based on the target environment. The tool is designed for modularity — the attacker specifies which driver to abuse, making signature-based detection harder. Includes anti-analysis features and supports multiple exploitation paths.
**Terminator (Spyboy, 2023):** Sold on cybercrime forums as a commercial EDR-killing service. Abuses the Zemana Anti-Malware driver (zam64.sys/zamguard64.sys) to terminate security processes. Advertised as capable of killing 23+ EDR/AV products. The driver is legitimately signed by Zemana and provides kernel-level file/process operations.
**SCATTERED SPIDER / BYOVD Campaign (CrowdStrike, January 2023):** SCATTERED SPIDER (Roasted 0ktapus/UNC3944) deployed malicious kernel drivers through CVE-2015-2291, a vulnerability in the Intel Ethernet diagnostics driver (iqvw64.sys). The malicious driver specifically targeted CrowdStrike Falcon's kernel component (csagent.sys), scanning for hard-coded byte patterns and patching routines with trampoline code. Drivers were signed with stolen NVIDIA and Global Software LLC certificates. The malicious driver used XOR decryption (key: i % 56 + 49) to reveal its target process list.
The fundamental problem is architectural: Windows allows any driver with a valid (or once-valid) signature to load into the kernel, where it can manipulate any process, memory region, or security control. Microsoft's Vulnerable Driver Blocklist (enabled by default since Windows 11 2022 update) blocks known-bad drivers but is incomplete, updated infrequently (1-2 times per year via major Windows releases), and does not cover newly discovered vulnerable drivers. The LOLDrivers.io project catalogs 700+ vulnerable and malicious drivers with hashes, providing the community's most comprehensive driver blocklist.
MITRE ATT&CK techniques used in TL-2026-0091
credential-access
defense-evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1574.002 DLL Side-Loading
lateral-movement
T1021.002 SMB/Windows Admin Shares
discovery
T1057 Process Discovery; T1518.001 Security Software Discovery
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1106 Native API; T1569.002 Service Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
initial-access
T1078 Valid Accounts; T1133 External Remote Services
command-and-control
T1090 Proxy; T1572 Protocol Tunneling
impact
T1486 Data Encrypted for Impact; T1489 Service Stop
persistence
T1543.003 Windows Service; T1547.006 Kernel Modules and Extensions
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall; T1688 Safe Mode Boot
resource-development
Remediation for BYOVD EDR Killer Tooling
Patches
- CVE-2015-2291 — Intel iqvw64.sys patched (but old versions widely available for BYOVD)
- Microsoft Vulnerable Driver Blocklist — updated periodically via Windows Update
- LOLDrivers.io community blocklist — continuously updated
Immediate actions
- Enable Microsoft Vulnerable Driver Blocklist on all Windows endpoints (Settings > Privacy & Security > Windows Security > Device Security > Core Isolation)
- Deploy the latest WDAC/App Control blocklist from Microsoft — the OS-shipped version lags behind
- Enable HVCI (Hypervisor-Protected Code Integrity) to enforce driver signing at hypervisor level
- Enable ASR rule 'Block abuse of exploited vulnerable signed drivers' in Microsoft Defender
- Monitor for kernel driver load events (Sysmon EventCode 6) from unexpected paths
- Block known BYOVD drivers by hash at endpoint: iqvw64.sys, PROCEXP152.sys (when dropped outside Sysinternals), zam64.sys
Workarounds
- Restrict local admin privileges — BYOVD requires admin to load drivers
- Deploy application control (WDAC/AppLocker) to prevent unauthorized driver installation
- Monitor for driver loading from TEMP, Downloads, or other non-standard paths
Longer-term hardening
- Deploy LOLDrivers.io blocklist as supplementary WDAC policy — covers 700+ drivers not in Microsoft's default list
- Implement driver allowlisting: only permit known-good kernel drivers to load
- Enable Windows Defender Credential Guard and Secure Boot to limit kernel attack surface
- Deploy EDR solutions with kernel-level self-protection (e.g., Protected Process Light / PPL)
- Monitor for sc.exe creating new kernel services or loading drivers outside standard paths
- Audit code-signing certificates — revoked certificates should not be trusted for driver loading
- Implement ELAM (Early Launch Anti-Malware) drivers that load before third-party drivers
CVEs associated with BYOVD EDR Killer Tooling
CVE-2015-2291, CVE-2018-19320
Weaknesses (CWE) in BYOVD EDR Killer Tooling
Timeline of BYOVD EDR Killer Tooling
Showing the 20 most recent tracked events.
- Sophos reports RobbinHood ransomware loading GIGABYTE gdrv.sys (CVE-2018-19320) plus malicious RBNL.SYS via ROBNR.EXE, with STEEL.EXE removing security products before encryption. Source: Sophos
- Microsoft launches Vulnerable and Malicious Driver Reporting Center, acknowledging adversaries increasingly leverage legitimate signed drivers. Source: Microsoft Security Blog
- Trend Micro discovers ransomware actor abusing Genshin Impact anti-cheat driver (mhyprot2.sys) for kernel-level AV termination via IOCTL 0x81034000. First documented gaming anti-cheat driver abuse in BYOVD. Source: Trend Micro
- Mandiant/Microsoft discover Poortry/Stonestop: malicious kernel driver signed with legitimate Microsoft WHCP certificates. Used by UNC3944/SCATTERED SPIDER and CUBA ransomware. Catastrophic failure of code-signing trust model.
- CISA adds CVE-2018-19320 (GIGABYTE gdrv.sys) to the Known Exploited Vulnerabilities Catalog. Source: CISA KEV
- Windows 11 2022 update enables Vulnerable Driver Blocklist by default for all devices. However, the blocklist is incomplete and updated only 1-2 times per year. Source: Microsoft
- CrowdStrike publishes analysis of SCATTERED SPIDER using CVE-2015-2291 (iqvw64.sys) to deploy malicious kernel driver targeting csagent.sys. Driver signed with stolen NVIDIA and Global Software LLC certificates. Source: CrowdStrike
- CISA adds CVE-2015-2291 (Intel Ethernet diagnostics driver iqvw64.sys) to the Known Exploited Vulnerabilities Catalog. Source: CISA KEV
- Sophos discovers AuKill: EDR-killer tool abusing Sysinternals Process Explorer driver (PROCEXP152.sys) to terminate 50+ security processes. Deployed with Medusa Locker and LockBit ransomware. Source: Sophos
- Spyboy advertises 'Terminator' EDR killer on cybercrime forums. Abuses Zemana Anti-Malware driver (zam64.sys) to terminate 23+ EDR/AV products. Sold as commercial service.
- LOLDrivers.io project launches, cataloging 700+ vulnerable and malicious kernel drivers with hashes, detection rules, and MITRE mappings. Becomes the community standard for driver blocklisting. Source: https://www.loldrivers.io/
- May 2024 (day unspecified): Sophos observes RansomHub operators attempting EDRKillShifter during an intrusion; the EDR kill and ransomware execution fail. Source: Sophos
- Sophos discovers EDRKillShifter: modular EDR-killer used by RansomHub affiliates. Dynamically selects vulnerable drivers based on target environment. Includes anti-analysis features. Source: Sophos
- Trellix-documented kill-floor.exe campaign reported: drops Avast Anti-Rootkit driver aswArPot.sys as ntfs.bin and terminates 142 hardcoded security processes across 7 vendors. Source: Trellix via SecurityAffairs/BleepingComputer
- Qilin affiliate intrusion begins via SSL VPN with stolen MSP credentials (from 31.192.107.144), later abusing Toshiba TPwSav.sys through customized EDRSandblast to remove EDR callbacks. Source: Blackpoint Cyber
- Blackpoint Cyber publishes Qilin BYOVD analysis: TPwSav.sys abuse, DLL side-loading via Carbon Black updater, EDR kernel-callback removal. Source: Blackpoint Cyber
- Halcyon estimates ~25% of 2024 ransomware attacks used BYOVD, a ~23% rise in Q2 2024 vs Q1, and says the Microsoft Vulnerable Driver Blocklist covers only ~5% of tracked vulnerable drivers. Source: Halcyon
- Microsoft updates recommended driver block rules documentation. Blocklist expanded but still acknowledged as incomplete — holds back some blocks to avoid breaking functionality. Source: Microsoft Learn
- Picus Security publishes comprehensive BYOVD explainer covering attack chain, mhyprot2.sys case study, HVCI defense guidance, and Sysmon Event ID 6 detection configurations. Source: Picus Security
- As of 2026-05-29, BYOVD EDR-killer tooling is still active and escalating: ESET (Mar 2026) tracks 54 BYOVD killers abusing 35 signed drivers, and Huntress + Reynolds ransomware incidents (Feb 2026) show live pre-encryption use. CVE-2015-2291 remains in CISA KEV; no takedown or successor exists, so status stays ACTIVE.
Update history for TL-2026-0091
- 2026-10-21 — BYOVD (Bring Your Own Vulnerable Driver) EDR Evasion: Signed Vulnerable Drivers (gdrv.sys CVE-2018-19320, iqvw64.sys CVE-2015-2291, aswArPot.sys, TPwSav.sys) Abused by Ransomware and eCrime Actors: What changed No field escalations. Severity (HIGH), status (ACTIVE), motivation (FINANCIAL) and attribution confidence (HIGH) match the newer report. Scope grows: a second KEV-listed driver CVE (CVE-2018-19320, gdrv.sys) and three more docu
Sources cited for BYOVD EDR Killer Tooling
- CrowdStrike: SCATTERED SPIDER BYOVD Attack on Falcon Sensor
- Microsoft: Recommended Driver Block Rules
- LOLDrivers.io — Living Off The Land Drivers
- MITRE ATT&CK — T1562.001: Impair Defenses: Disable or Modify Tools
- Sophos: AuKill Abuses Process Explorer Driver
- Sophos: EDRKillShifter — RansomHub EDR Killer
- NVD — CVE-2015-2291: Intel Ethernet Diagnostics Driver
- Microsoft: Improve Kernel Security with Vulnerable Driver Reporting Center
- OpenText EnCase Forensic — Legitimate Forensic Software
- MITRE ATT&CK — T1068: Exploitation for Privilege Escalation
- What Are Bring Your Own Vulnerable Driver (BYOVD) Attacks?
Detection coverage for TL-2026-0091
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0091 across Splunk SPL, Microsoft KQL and Sigma, covering 59 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.