Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer via Weaponized ThrottleStop Driver (CVE-2025-7771) — Threadlinqs Intelligence
As of 2026-07-17, Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer via Weaponized ThrottleStop Driver (CVE-2025-7771) is a high-severity ransomware threat attributed to Qilin, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1453 · Severity: HIGH · CVSS: 8.7 · Status: ACTIVE · Category: RANSOMWARE
Attribution: Qilin · FINANCIAL
Flashpoint's reverse engineering of Qilin's infection chain reveals a custom Rust loader that reflectively loads the ransomware payload via per-sample obfuscated deobfuscation, and a
Flashpoint published a deep technical teardown of the Qilin ransomware operation's infection chain, focused on two components: a custom Rust-language loader and a kernel-level EDR-killer driver-abuse module. The Rust loader performs reflective PE loading of the embedded ransomware payload directly in-process (avoiding classic process-injection tradecraft): it walks the embedded byte blob one DWORD at a time, allocates space on the heap, and deobfuscates each DWORD through a chain of arithmetic operations that is randomized per compiled sample, ultimately yielding a valid 'MZ' PE header in memory. Because the deobfuscation routine differs per sample, Flashpoint built an automated CPU-emulation-based unpacker that pattern-matches the unpacking routine inside each binary and reports a 100% success rate recovering the embedded configuration/payload without manual reversing per sample.
The EDR-killer component is distributed packed by the 'Shanya' packer-as-a-service (also documented independently by Sophos in December 2025 as 'Shanya', aka VX Crypt), which originally sold for $100-150 in 2024 and now commands roughly $2,000 per build. Shanya-packed binaries employ junk-code insertion, API-name hashing (a bitwise OR of each character against 0x20, i.e., case-folding-style hashing used to resolve WinAPI addresses without importing them by name), IAT hooking, pattern-scanning anti-analysis checks (including abuse of RtlDeleteFunctionTable to crash debuggers), Process-Environment-Block (PEB) abuse to stash configuration data, DLL side-loading for execution, and Vectored Exception Handler (VEH)-based control-flow obfuscation to defeat static and dynamic analysis tooling.
Once running, the EDR-killer drops two drivers: the legitimately Microsoft/vendor-signed but vulnerable TechPowerUp ThrottleStop.sys (a CPU-throttling-correction utility driver, versions including 3.0.0.0, tracked as CVE-2025-7771 / GHSA-f8p7-vvxp-hcxv / LOLDrivers entry 6e0786f5-2168-40a8-a068-e261c4eb10e7) and a second, unsigned driver that receives kill commands from the user-mode component. ThrottleStop.sys exposes two IOCTL interfaces built on an insecure MmMapIoSpace() call that grant arbitrary physical-memory read/write to any local caller. The EDR-killer uses this to build a full physical-memory map via the Windows memory-management service, recording Page Frame Number (PFN) metadata in a global structure, giving it a direct kernel read/write primitive without ever loading its own signed driver in the conventional sense.
With kernel read/write established, the malware locates the Code Integrity subsystem's callback table (SeCiCallbacks) and patches the driver-signature verification routine with a stub/dummy function, disabling Windows' built-in unsigned-driver-loading enforcement. This lets it load its unsigned kill-driver despite Driver Signature Enforcement (DSE) being nominally active. The kill-driver then enumerates the kernel's process-creation, thread-creation, image-load, and registry/minifilter notify-callback arrays; for each entry whose owning module address matches a hardcoded blacklist of security-product driver base addresses, it zeroes out the callback pointer in place, silently blinding EDR/AV telemetry for that product without unloading or crashing the driver (which would itself be detected). Separately, the malware manipulates the target security-product executable's DACL by constructing a new, empty ACL (SE_DACL_PRESENT set TRUE, zero ACEs) — deliberately distinguished in the code from a NULL DACL (everyone-full-access) — so that the EDR binary cannot be deleted or restarted by legitimate services, without needing to touch the file's contents.
Operationally, the malware performs environment checks before detonating: it queries the system locale and refuses to run in CIS countries (Russia, Belarus explicitly called out), consistent with Qilin's Russian-speaking-affiliate RaaS model. It attempts to acquire SE_PROF_SINGLE_PROCESS_PRIVILEGE, S
Weaknesses (CWE)
CWE-284, CWE-269, CWE-347
Target sectors: manufacturing, professional-scientific-services, wholesale-trade, health, government administration, financial-services
Target regions: Global, North America, Europe, united kingdom, south korea
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, CVE-2025-7771, T1566, T1078, T1133, T1204, T1106, T1059, T1547, T1068, T1134, T1562