The BYOVD Epidemic: Attackers Weaponize Trusted Windows Drivers to Kill Security Software
The BYOVD Epidemic (TL-2026-2297), also tracked as BYOVD Epidemic, is a high-severity ransomware operation, first published 2026-06-30. It has no confirmed attribution, affects Adlice Software RogueKiller / TrueSight Anti-Rootkit Driver, references 1 CVE (CVE-2013-3900), maps to 12 MITRE ATT&CK techniques (T1014, T1027, T1036.005), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-2297
- Threat ID
- TL-2026-2297
- Also known as
- BYOVD Epidemic, Bring Your Own Vulnerable Driver
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-30
- Last reviewed
- 2026-06-30
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- telecoms, business process outsourcing, managed service providers, financial services, cryptocurrency, entertainment, transport, health
- Target regions
- Asia-Pacific, North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in The BYOVD Epidemic
Malware and tooling: AgendaCrypt, AuKill, BlackCat/ALPHV, Ghost RAT, HiddenGh0st, LockBit, MedusaLocker, POORTRY, WarLock, AuKill, GhostDriver, POORTRY
Bring Your Own Vulnerable Driver (BYOVD) has evolved from a niche technique into a standard defense-evasion stage of the ransomware playbook: attackers with administrator rights load signed-but-vulnerable kernel drivers (truesight.sys, an outdated Process Explorer driver, Microsoft-signed POORTRY) to terminate or blind AV/EDR agents ahead of encryption. Public tooling (TrueSightKiller, AuKill, GhostDriver, STONESTOP/POORTRY) and 2026 campaigns from Qilin and Warlock show the technique is now commodity-grade and used across multiple ransomware-as-a-service operations.
How The BYOVD Epidemic works
BYOVD abuses the trust the Windows kernel places in digitally signed drivers: an attacker with local administrator rights loads a legitimate, signed driver that contains an exploitable flaw (arbitrary process termination, arbitrary read/write of kernel memory) instead of writing their own unsigned rootkit. Because the driver's signature validates, the load succeeds even under Driver Signature Enforcement, and the attacker gets Ring 0 code execution to unhook AV/EDR kernel callbacks and force-terminate protected security processes before ransomware deployment.
The technique now spans several distinct lineages of vulnerable/abused drivers. Adlice's RogueKiller anti-rootkit driver, truesight.sys, contains an arbitrary-process-termination flaw in versions below 3.4.0; the legacy 2.0.2 build remains exploitable even after later fixes. Starting mid-2024, a China-nexus cluster tracked as Silver Fox (medium-to-high confidence, per Check Point Research) weaponized this legacy driver at scale, exploiting CVE-2013-3900 (an Authenticode/WinVerifyTrust signature-validation gap) to modify the PE checksum and certificate padding of the driver without invalidating its digital signature. This let them mint over 2,500 distinct signed variants of the same vulnerable driver, defeating hash-based detection while delivering a custom Gh0st RAT variant (HiddenGh0st) from Alibaba Cloud OSS infrastructure. Microsoft's December 17, 2024 Vulnerable Driver Blocklist update targeted this family, but the legacy 2.0.2 build initially evaded it due to certificate-chain differences, and public exploitation tooling (TrueSightKiller) is freely available.
A second lineage abuses an outdated Sysinternals Process Explorer driver (v16.32). The open-source tool AuKill, built on techniques from the 2021 tool Backstab, drops this outdated driver as PROCEXP.SYS into C:\Windows\System32\drivers (alongside the legitimate current PROCEXP152.sys) and uses it to disable EDR/AV processes. At least six AuKill versions have been observed since November 2022; the tool was used ahead of Medusa Locker ransomware deployments in January-February 2023 and a LockBit deployment in February 2023.
A third lineage involves drivers that obtained legitimate Microsoft code-signing rather than exploiting a third-party driver's bug. In December 2022, Mandiant and SentinelOne disclosed the STONESTOP/POORTRY toolkit: POORTRY is a kernel-mode driver that STONESTOP (a user-mode loader) uses to terminate protected security processes and delete files, and it was signed via abuse of the Windows Hardware Compatibility Program (WHCP) after malicious actors compromised legitimate Microsoft Partner Center developer accounts. The toolkit has since been used by UNC3944 (aka Scattered Spider) and multiple ransomware operators including LockBit, BlackCat/ALPHV, Cuba, Medusa, and RansomHub, targeting telecommunications, BPO, MSSP, financial services, cryptocurrency, entertainment, and transportation organizations.
Most recently (April 2026), Cisco Talos and Trend Micro documented Qilin and Warlock ransomware building BYOVD directly into their intrusion chains: Qilin side-loads a malicious msimg32.dll that stages rwdrv.sys (a renamed ThrottleStop.sys providing raw physical-memory access) and hlpdrv.sys, which together terminate processes from over 300 different EDR/AV products after first unregistering kernel callbacks so no alert fires. Warlock combined an NSec vulnerable driver with the TightVNC remote-access tool in BYOVD intrusions against vulnerable on-premises Microsoft SharePoint servers. GhostDriver, a further open-source automation tool, similarly drives IOCTLs against a hardcoded, actively maintained list of 300+ targeted security products. Symantec's Threat Hunter Team (June 2026) frames the collective pattern as hundreds of exploitable drivers already in circulation, with publicly known bypasses for kernel hardening features (KASLR, HVCI, KCFG) meaning the mitigations most organizations rely on do not reliably stop it.
MITRE ATT&CK techniques used in TL-2026-2297
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Execution
T1204.002 User Execution: Malicious File; T1569.002 System Services: Service Execution
Command and Control
Discovery
T1518.001 Security Software Discovery
Persistence
T1543.003 Create or Modify System Process: Windows Service
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools
Resource Development
T1588.002 Obtain Capabilities: Tool; T1588.003 Obtain Capabilities: Code Signing Certificates
Affected products and versions in The BYOVD Epidemic
- Adlice Software — RogueKiller / TrueSight Anti-Rootkit Driver (truesight.sys)
Vulnerable versions: <=2.0.2; <3.4.0
Fixed in: 3.4.0+ - Microsoft Sysinternals — Process Explorer Driver (PROCEXP.SYS)
Vulnerable versions: 16.32 and earlier (outdated release abused by AuKill)
Fixed in: Current Sysinternals release shipping PROCEXP152.sys - Microsoft — Windows kernel driver loading / Vulnerable Driver Blocklist
Vulnerable versions: Systems without HVCI/Smart App Control enabled or running a stale blocklist
Fixed in: Windows 10 (KB5018482) / Windows 11 (KB5018483, KB5018496) with the current blocklist enforced
Remediation for The BYOVD Epidemic
Patches
- Update Adlice TrueSight/RogueKiller driver to 3.4.0 or later.
- Replace outdated Sysinternals Process Explorer driver releases (pre-16.33 successor) with current signed builds.
Immediate actions
- Manually push the latest Microsoft Vulnerable Driver Blocklist rather than waiting for the annual Windows feature-update cadence.
- Enable HVCI (Memory Integrity) / Smart App Control so blocklist entries are actually enforced rather than left as advisory.
- Block known malicious driver hashes (AuKill v1-v6, truesight.sys 2.0.2-derived variants) at the EDR/AV layer.
Workarounds
- Restrict local administrator rights required to load arbitrary kernel drivers.
- Use application control to block execution of known BYOVD loader tools (AuKill, GhostDriver, TrueSightKiller, STONESTOP).
Longer-term hardening
- Deploy WDAC driver allowlisting rather than relying solely on the default vulnerable-driver blocklist.
- Monitor kernel driver load events (e.g. Sysmon Event ID 6) for unsigned, rarely-seen, or non-standard-path drivers.
- Alert on anomalous IOCTL calls and kernel-callback removal/unregistration targeting security-product processes.
CVEs associated with The BYOVD Epidemic
CVE-2013-3900
Weaknesses (CWE) in The BYOVD Epidemic
CWE-347
Timeline of The BYOVD Epidemic
- Backstab, the open-source EDR-killing tool later adapted into AuKill, is published.
- Earliest known AuKill (v1) sample compiled, abusing the outdated Process Explorer v16.32 driver (PROCEXP.SYS).
- Mandiant and SentinelOne disclose the STONESTOP/POORTRY BYOVD toolkit and the Windows Hardware Compatibility Program signing loophole abused by UNC3944 to get POORTRY Microsoft-signed.
- AuKill used to disable EDR ahead of Medusa Locker ransomware deployments (January-February 2023 incidents).
- AuKill used to disable EDR immediately prior to a LockBit ransomware deployment.
- Sophos publishes technical research on AuKill, cataloguing six driver-dropper versions observed since November 2022.
- Silver Fox begins large-scale exploitation of the legacy truesight.sys 2.0.2 driver to deliver a Gh0st RAT variant (HiddenGh0st), per Check Point telemetry.
- Silver Fox shifts to generating thousands of checksum/signature-preserving truesight.sys variants (ultimately 2,500+ unique hashes) via CVE-2013-3900 to evade hash-based detection.
- Microsoft updates the Vulnerable Driver Blocklist to block the modified truesight.sys variant family.
- Check Point Research and The Hacker News publish findings on the 2,500+ truesight.sys driver-variant campaign, noting the legacy 2.0.2 build initially evaded the December 2024 blocklist update.
- Cisco Talos and Trend Micro document Qilin and Warlock ransomware BYOVD chains: msimg32.dll/rwdrv.sys/hlpdrv.sys terminating 300+ EDR products, and Warlock's NSec driver + TightVNC intrusion against on-prem SharePoint.
- Symantec/Broadcom Threat Hunter Team publishes 'The BYOVD Epidemic,' documenting BYOVD's evolution into a standard component of the ransomware playbook.
Sources cited for The BYOVD Epidemic
- The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security
- 2,500+ Truesight.sys Driver Variants Exploited to Bypass EDR
- Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign
- 'AuKill' EDR killer malware abuses Process Explorer driver
- Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access (STONESTOP/POORTRY)
- Microsoft-signed malicious Windows drivers used in ransomware attacks
- Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools
- BYOVD technique employed by Qilin, Warlock ransomware gangs
- 'Silver Fox' APT Skirts Windows Blocklist in BYOVD Attack
- Exploiting truesight.sys to kill AVs
More in ransomware
- Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References
- Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion
- Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data exfiltration alleged
Detection coverage for TL-2026-2297
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2297 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.