MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse

MoiClient Backdoor (TL-2026-2288) is a high-severity malware campaign, first published 2026-09-02. It has no confirmed attribution, affects Lenovo Lenovo PC Manager (BootRepair.Sys driver), maps to 12 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-2288

Threat ID
TL-2026-2288
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-02
Last reviewed
2026-09-02
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
15

Malware and tooling in MoiClient Backdoor

Malware and tooling: MoiClient, MoiXD Stealer, ChromElevator, defendnot

AhnLab ASEC documents MoiClient, a backdoor distributed via email as a disguised invoice, that side-loads through a renamed SumatraPDF viewer, injects into explorer.exe, bypasses UAC through the AppInfo RPC service, and abuses the vulnerable signed Lenovo PC Manager driver BootRepair.Sys to kill security processes before delivering the MoiXD Stealer.

How MoiClient Backdoor works

MoiClient is distributed by email as a .vhdx attachment disguised as an invoice. The virtual disk contains Invoice.Pdf.Exe, a renamed copy of the legitimate SumatraPDF viewer, and a malicious uxtheme.Dll placed in the same directory. When the victim opens Invoice.Pdf.Exe, the DLL search order causes SumatraPDF to load uxtheme.Dll automatically (classic DLL side-loading), silently executing MoiClient under the trust of a signed, legitimate PDF viewer.

Once running, uxtheme.Dll creates a suspended explorer.exe process, inserts shellcode staged in a companion file (data.Dat) at the process entry point, and resumes it, so MoiClient's core logic executes entirely inside a legitimate system process rather than as a standalone binary on disk.

MoiClient then escalates privileges without triggering a UAC prompt by interacting directly with the AppInfo (Application Information) service over its local ncalrpc RPC interface. This coerces the auto-elevating ComputerDefaults.Exe into launching with administrator rights; the malware's own sc.exe and PowerShell invocations inherit that elevated token, giving it silent, prompt-free administrative access.

With elevated privileges, MoiClient performs a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack: it drops the legitimately Lenovo-signed but vulnerable BootRepair.Sys driver (Lenovo PC Manager v2.5.30.11281) as moimoi.Sys under %Public% and loads it as a kernel service. BootRepair.Sys exposes an unauthenticated IOCTL (control code 0x222014) that takes a raw process ID and passes it directly to the kernel API ZwTerminateProcess with no access-control check, letting any caller kill any process at ring 0. MoiClient uses this to enumerate and terminate Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee processes. Artifacts consistent with the public 'defendnot' technique (defendnot-loader.Exe, defendnot.Dll) are also present on affected hosts; defendnot separately neutralizes Windows Defender by registering a fake antivirus product through the undocumented Windows Security Center (WSC) API after DLL-injecting into a trusted signed process such as Taskmgr.exe, so Defender disables itself to avoid a conflict.

Persistence is established via a Task Scheduler entry named "MicrosoftWindowsUpdateTask" suffixed with a random four-digit number (or an appended period if the task already exists), masquerading as a Windows Update task. It fires every 30 minutes to relaunch the renamed SumatraPDF binary (demo.exe) and reload uxtheme.Dll, re-arming the infection chain across reboots and process termination.

MoiClient's final-stage payload, MoiXD Stealer, harvests browser-stored credentials entirely in memory using a ChromElevator-style bypass of Chromium's App-Bound Encryption (ABE): it hijacks the identity of a legitimate, trusted browser process to call the browser's own IElevator/IElevator2 COM decryption interface and recover the ABE master key, then decrypts cookies, saved passwords, and other protected browser data without ever touching disk.

No CVE has been assigned to BootRepair.Sys; it is catalogued in the LOLDrivers vulnerable-driver database without a CVE ID, distinct from the unrelated, separately-numbered CVE-2025-8061 affecting a different Lenovo Process Management driver (LnvMSRIO.sys). No C2 domains, IPs, or file hashes for the MoiClient/MoiXD components themselves were published in the source reporting.

MITRE ATT&CK techniques used in TL-2026-2288

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Injection: Process Hollowing; T1574.001 DLL; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service

Execution

T1204.002 User Execution: Malicious File

Privilege Escalation

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Initial Access

T1566.001 Phishing: Spearphishing Attachment

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in MoiClient Backdoor

  • Lenovo — Lenovo PC Manager (BootRepair.Sys driver)
    Vulnerable versions: 2.5.30.11281
  • SumatraPDF — SumatraPDF viewer (abused host binary for DLL side-loading; not itself the vulnerable component)

Remediation for MoiClient Backdoor

Patches

  • No CVE has been assigned to BootRepair.Sys; where Lenovo PC Manager is not required, remove it or block the driver via WDAC rather than waiting on a vendor patch
  • Keep Chromium-based browsers current, as App-Bound Encryption bypass techniques (ChromElevator-class) are actively being refined against IElevator/IElevator2

Immediate actions

  • Block or quarantine SumatraPDF binaries renamed to invoice-themed filenames (e.g. Invoice.Pdf.Exe) delivered as .vhdx email attachments
  • Alert on and block loading of any driver matching the BootRepair.Sys hash set (SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946) outside a legitimate Lenovo PC Manager installation path
  • Hunt for Task Scheduler tasks matching the pattern 'MicrosoftWindowsUpdateTask' followed by a 4-digit number that relaunch a PDF-viewer binary every 30 minutes
  • Investigate any host where Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, or McAfee processes terminate unexpectedly at the same time

Workarounds

  • Add the BootRepair.Sys hash set to a driver deny-list (WDAC/Smart App Control) even on systems without Lenovo hardware
  • Restrict inbound email delivery of .vhdx/.vhd virtual-disk attachments at the gateway
  • Restrict Task Scheduler task creation from user-writable %LOCALAPPDATA% paths

Longer-term hardening

  • Enforce Microsoft's vulnerable-driver blocklist (WDAC/HVCI) and keep it updated to cover BootRepair.Sys and other LOLDrivers-catalogued kernel drivers
  • Enable Protected Process Light / tamper protection for endpoint security agents so unauthenticated kernel IOCTL calls cannot terminate them
  • Monitor and restrict local RPC (ncalrpc) calls to the AppInfo service and flag ComputerDefaults.Exe launches followed by elevated sc.exe or PowerShell child processes
  • Monitor Windows Security Center (WSC) provider registrations for unrecognized antivirus product names that coincide with Defender disabling itself

Weaknesses (CWE) in MoiClient Backdoor

CWE-284, CWE-862, CWE-427

Timeline of MoiClient Backdoor

  • MoiClient delivers the MoiXD Stealer payload, which uses a ChromElevator-style App-Bound Encryption bypass to decrypt and steal browser-stored passwords and credentials entirely in memory.
  • MoiClient registers a Task Scheduler task named 'MicrosoftWindowsUpdateTask' plus a random four-digit suffix that fires every 30 minutes to relaunch the renamed SumatraPDF binary (demo.exe) and reload uxtheme.Dll.
  • MoiClient drops the vulnerable, Lenovo-signed BootRepair.Sys driver as moimoi.Sys under %Public%, loads it as a kernel service, and abuses its unauthenticated IOCTL 0x222014 to terminate Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee processes.
  • MoiClient calls the AppInfo service's local ncalrpc RPC interface to force ComputerDefaults.Exe to auto-elevate, granting its own sc.exe and PowerShell child processes administrator privileges without a UAC prompt.
  • uxtheme.Dll creates a suspended explorer.exe process and injects shellcode staged in data.Dat into its entry point, executing MoiClient in memory inside a trusted system process.
  • Victim opens Invoice.Pdf.Exe, a renamed SumatraPDF viewer bundled in the .vhdx, triggering automatic loading of the malicious uxtheme.Dll from the same directory (DLL side-loading).
  • AhnLab ASEC publishes analysis of the MoiClient backdoor, documenting distribution via a .vhdx email attachment disguised as an invoice.

Sources cited for MoiClient Backdoor

More in malware

Detection coverage for TL-2026-2288

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2288 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2288

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats