The Akira ransomware, which has been surging in popularity lately, has also been used recently by hackers in conjunction with a legitimate Intel CPU tuning driver to disable Microsoft Defender.
As reported by Bleeping Computer, the attacks are registering the driver as a service in order to gain kernel-level access.
These types of attacks are often referred to as BYOVD ‘Bring Your Own Vulnerable Driver,’ as they’re used when threat actors already have a legitimate signed driver with known weaknesses that can be exploited to achieve privilege escalation. They are then, as is the case with the above drivers, used to load malicious tools or disable antivirus software.
The researchers at Guidepoint Security have provided a YARA rule, complete indicators of compromise (IoCs), service names and file paths to help defend against and block these attacks. Additionally, they recommend having system administrations monitor for Akira-related activity, apply filters and blocks as indicators emerge – and make sure to only download software from official sites and trusted sources as malicious sites and mimicked sources have become a more and more common way to distribute such malware.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
More from Tom's Guide
- Hackers are using fake TikTok Shops to steal money and spread malware — don't fall for this
- From AI training to banning VPNs – here are 8 questions the internet is asking about the Online Safety Act
- Jury finds Meta illegally collected data from women's health app Flo — what you need to know
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
