# Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer via Weaponized ThrottleStop Driver (CVE-2025-7771)

> Flashpoint's reverse engineering of Qilin's infection chain reveals a custom Rust loader that reflectively loads the ransomware payload via per-sample obfuscated deobfuscation, and a Shanya-packer-wrapped EDR-killer that abuses CVE-2025-7771 in the legitimately signed TechPowerUp ThrottleStop.sys driver to map physical memory, patch the Code Integrity callback table to bypass driver signing enforcement, and surgically unlink kernel-mode process, thread, image-load, and registry callbacks belonging to security products. Qilin (RaaS, active since mid-2022 under the Agenda/Qilin brand) has used this ThrottleStop BYOVD technique continuously since May 2024, and the same vulnerable driver plus the Shanya packer-as-a-service have independently been observed in Akira, Medusa, Crytox, MedusaLocker, and Gentlemen ransomware operations, indicating a shared criminal tooling supply chain.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1453
- **ID:** TL-2026-1453
- **Severity:** HIGH (CVSS 8.7)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-7771

## Description

Flashpoint published a deep technical teardown of the Qilin ransomware operation's infection chain, focused on two components: a custom Rust-language loader and a kernel-level EDR-killer driver-abuse module. The Rust loader performs reflective PE loading of the embedded ransomware payload directly in-process (avoiding classic process-injection tradecraft): it walks the embedded byte blob one DWORD at a time, allocates space on the heap, and deobfuscates each DWORD through a chain of arithmetic operations that is randomized per compiled sample, ultimately yielding a valid 'MZ' PE header in memory. Because the deobfuscation routine differs per sample, Flashpoint built an automated CPU-emulation-based unpacker that pattern-matches the unpacking routine inside each binary and reports a 100% success rate recovering the embedded configuration/payload without manual reversing per sample.

The EDR-killer component is distributed packed by the 'Shanya' packer-as-a-service (also documented independently by Sophos in December 2025 as 'Shanya', aka VX Crypt), which originally sold for $100-150 in 2024 and now commands roughly $2,000 per build. Shanya-packed binaries employ junk-code insertion, API-name hashing (a bitwise OR of each character against 0x20, i.e., case-folding-style hashing used to resolve WinAPI addresses without importing them by name), IAT hooking, pattern-scanning anti-analysis checks (including abuse of RtlDeleteFunctionTable to crash debuggers), Process-Environment-Block (PEB) abuse to stash configuration data, DLL side-loading for execution, and Vectored Exception Handler (VEH)-based control-flow obfuscation to defeat static and dynamic analysis tooling.

Once running, the EDR-killer drops two drivers: the legitimately Microsoft/vendor-signed but vulnerable TechPowerUp ThrottleStop.sys (a CPU-throttling-correction utility driver, versions including 3.0.0.0, tracked as CVE-2025-7771 / GHSA-f8p7-vvxp-hcxv / LOLDrivers entry 6e0786f5-2168-40a8-a068-e261c4eb10e7) and a second, unsigned driver that receives kill commands from the user-mode component. ThrottleStop.sys exposes two IOCTL interfaces built on an insecure MmMapIoSpace() call that grant arbitrary physical-memory read/write to any local caller. The EDR-killer uses this to build a full physical-memory map via the Windows memory-management service, recording Page Frame Number (PFN) metadata in a global structure, giving it a direct kernel read/write primitive without ever loading its own signed driver in the conventional sense.

With kernel read/write established, the malware locates the Code Integrity subsystem's callback table (SeCiCallbacks) and patches the driver-signature verification routine with a stub/dummy function, disabling Windows' built-in unsigned-driver-loading enforcement. This lets it load its unsigned kill-driver despite Driver Signature Enforcement (DSE) being nominally active. The kill-driver then enumerates the kernel's process-creation, thread-creation, image-load, and registry/minifilter notify-callback arrays; for each entry whose owning module address matches a hardcoded blacklist of security-product driver base addresses, it zeroes out the callback pointer in place, silently blinding EDR/AV telemetry for that product without unloading or crashing the driver (which would itself be detected). Separately, the malware manipulates the target security-product executable's DACL by constructing a new, empty ACL (SE_DACL_PRESENT set TRUE, zero ACEs) — deliberately distinguished in the code from a NULL DACL (everyone-full-access) — so that the EDR binary cannot be deleted or restarted by legitimate services, without needing to touch the file's contents.

Operationally, the malware performs environment checks before detonating: it queries the system locale and refuses to run in CIS countries (Russia, Belarus explicitly called out), consistent with Qilin's Russian-speaking-affiliate RaaS model. It attempts to acquire SE_PROF_SINGLE_PROCESS_PRIVILEGE, SE_DEBUG_PRIVILEGE, and SE_LOAD_DRIVER_PRIVILEGE token privileges to support the kernel-driver-loading and process-manipulation stages.

Qilin itself (tracked by other vendors as Agenda) is a Ransomware-as-a-Service operation first observed under the 'Agenda' brand around mid-2022, rebranding to 'Qilin' (a mythological Chinese creature) by September 2022. It is one of the most prolific RaaS operations tracked in 2025-2026, with roughly 1,500 claimed victims since launch and over 500 in 2026 alone (per MOXFIVE tracking), and was reported as the single most active ransomware brand by volume in an April 2026 30-day tracking window (~14% of all tracked ransomware activity). Affiliates reportedly retain 80-85% of ransom proceeds. Qilin's ransomware binary supports per-file selection between AES-256 (when AES-NI is available) and ChaCha20 (fallback) for bulk file encryption, layered with RSA-4096 for key wrapping, and drops a customized ransom note (branded 'CheckQilin' in some builds) referencing a Tor-hosted and clearweb-mirrored double-extortion leak site (observed clearweb mirror: wikileaks2.site). Reported initial-access vectors for Qilin affiliates include phishing/spear-phishing, valid-account abuse via compromised VPN credentials (including exploitation of compromised FortiGate SSL VPN appliances to pivot to failover infrastructure), and exploitation of internet-facing RMM tools and email gateways; lateral movement commonly leverages RDP, PsExec, GPO-based script deployment, Cobalt Strike for C2, and Mimikatz/browser-credential-theft for further credential harvesting. Manufacturing (~23% of victims), professional/scientific services (~18%), and wholesale trade (~10%) are the most heavily affected sectors, with a high-profile healthcare incident (Synnovis, UK, June 2024) cancelling over 6,000 hospital appointments/procedures.

The same ThrottleStop.sys BYOVD technique for AV/EDR killing (independent of Qilin) has been documented by Kaspersky/Securelist as used by a standalone 'AV Killer' tool and by Gentlemen ransomware, and by MedusaLocker operators in a Brazil-based incident analyzed in August 2025. The Shanya packer-as-a-service underlying the EDR-killer wrapper has separately been documented by Sophos as used across Akira, Qilin, Crytox, and Medusa ransomware families, as well as in ClickFix campaigns delivering CastleRAT malware, with telemetry showing samples in Tunisia, the UAE, Costa Rica, Nigeria, and Pakistan — establishing Shanya and the ThrottleStop BYOVD chain as shared, cross-group criminal tooling rather than Qilin-exclusive capability.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1204 User Execution
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1222 File and Directory Permissions Modification
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1553 Subvert Trust Controls
- T1112 Modify Registry
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1021 Remote Services
- T1072 Software Deployment Tools
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Inside Qilin Ransomware](https://flashpoint.io/blog/inside-qilin-ransomware/)
- [Inside Shanya, a packer-as-a-service fueling modern attacks](https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/)
- [CVE-2025-7771 — Local Privilege Escalation in ThrottleStop.sys](https://dbugs.ptsecurity.com/vulnerability/PT-2025-32145)
- [ThrottleStop.sys — arbitrary physical memory R/W via MmMapIoSpace (GHSA-f8p7-vvxp-hcxv)](https://github.com/advisories/GHSA-f8p7-vvxp-hcxv)
- [ThrottleStop driver abused to terminate AV processes](https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/)
- [K-TechPowerUp-2025-001 Advisory](https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md)
- [LOLDrivers entry for ThrottleStop.sys](https://www.loldrivers.io/drivers/6e0786f5-2168-40a8-a068-e261c4eb10e7/)
- [BYOVD attack exploits vulnerable ThrottleStop driver to disable AV defenses](https://www.broadcom.com/support/security-center/protection-bulletin/byovd-attack-exploits-vulnerable-throttlestop-driver-to-disable-av-defenses)
- [Qilin Ransomware (Agenda): A Deep Dive](https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/qilin-ransomware/)
- [Qilin: Top Ransomware Threat to SLTTs in Q2 2025](https://www.cisecurity.org/insights/blog/qilin-top-ransomware-threat-to-sltts-in-q2-2025)
- [The Evolution of Qilin RaaS](https://www.sans.org/blog/evolution-qilin-raas)
- [Qilin ransomware is growing, but how long will it last?](https://blog.barracuda.com/2025/07/18/qilin-ransomware-growing)
- [Uncovering Qilin attack methods exposed through multiple cases](https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/)
- [Qilin Ransomware 2026: TTPs, Victims and Defense Guide](https://www.moxfive.com/blog/qilin-ransomware-2026-ttps-victims-and-defense-guide)
- [The Korean Leaks – Hybrid Geopolitical Campaign Targeting South Korean Financial Services With Qilin RaaS](https://businessinsights.bitdefender.com/korean-leaks-campaign-targets-south-korean-financial-services-qilin-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1453