Silent Killers: Unmasking A Large-Scale Legacy Driver Exploitation Campaign

The talk opens with background on vulnerable drivers and why attackers use them to terminate protected security processes. The speaker, from Check Point Research, explains how a signed driver exposing process termination can serve as an EDR killer, and how a future-focused hunting approach was used to search public and internal telemetry for drivers not yet on blocklists.

The hunt surfaced a campaign attributed to the Chinese APT Silverfox. Its first-stage samples numbered in the hundreds of thousands, and they repeatedly dropped more than 2,500 variants of an old anti-rootkit driver, version 202, that was missing from Microsoft's blocklist because its certificate hash had not been added. The loader chain used three stages with encrypted payloads disguised as image files, loaded in memory and persisted through scheduled tasks and DLL side-loading. Variants were produced by altering the PE checksum and certificate padding, which kept signatures valid while defeating hash-based detection. The EDR-killing module, protected with VMProtect, was analysed by dumping process memory and rebuilding imports in IDA, which confirmed the same control code used to terminate processes.

The campaign ended with a Ghost RAT variant. For practitioners, the key takeaways are to rely on authentihash rather than file hashes for these drivers, to apply the vulnerable driver blocklist manually rather than waiting for infrequent automatic updates, and to treat old signed drivers with unusual service registrations as risky even when they are not flagged.