The Akira ransomware, which has been surging in popularity lately, has also been used recently by hackers in conjunction with a legitimate Intel CPU tuning driver to disable Microsoft Defender.
As reported by Bleeping Computer, the attacks are registering the driver as a service in order to gain kernel-level access.
The Intel CPU driver that is being abused is rwdrv.sys (used by ThrottleStop), and is likely used to load a secondary driver (hlpdrv.sys). That secondary driver is a malicious tool that causes Microsoft Defender to turn off protections.
These types of attacks are often referred to as BYOVD ‘Bring Your Own Vulnerable Driver,’ as they’re used when threat actors already have a legitimate signed driver with known weaknesses that can be exploited to achieve privilege escalation. They are then, as is the case with the above drivers, used to load malicious tools or disable antivirus software.
Researchers at Guidepoint Security, who reported seeing the malicious behavior, stated that when the second driver is executed it modifies the DisableAntiSpyware settings of Microsoft Defender within the Registry. The malware does this via the execution of regedit.exe.
The researchers at Guidepoint Security have provided a YARA rule, complete indicators of compromise (IoCs), service names and file paths to help defend against and block these attacks. Additionally, they recommend having system administrations monitor for Akira-related activity, apply filters and blocks as indicators emerge – and make sure to only download software from official sites and trusted sources as malicious sites and mimicked sources have become a more and more common way to distribute such malware.
It's always alarming when hackers figure out way out ways to abuse legitimate security tools in their attacks but fortunately, this attempt was spotted quickly and a fix was devised early enough before this campaign could do significant damage.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
