Hackers are abusing this Intel tool to disable Windows 11's built-in antivirus — don't fall for this

News
By published

The Akira ransomware can now disable Microsoft Defender on your PC

The Microsoft Defender Antivirus, aka Windows Defender, logo on the display of a laptop sitting on a table or desk.
(Image credit: monticello/Shutterstock)

The Akira ransomware, which has been surging in popularity lately, has also been used recently by hackers in conjunction with a legitimate Intel CPU tuning driver to disable Microsoft Defender.

As reported by Bleeping Computer, the attacks are registering the driver as a service in order to gain kernel-level access.

These types of attacks are often referred to as BYOVD ‘Bring Your Own Vulnerable Driver,’ as they’re used when threat actors already have a legitimate signed driver with known weaknesses that can be exploited to achieve privilege escalation. They are then, as is the case with the above drivers, used to load malicious tools or disable antivirus software.

The researchers at Guidepoint Security have provided a YARA rule, complete indicators of compromise (IoCs), service names and file paths to help defend against and block these attacks. Additionally, they recommend having system administrations monitor for Akira-related activity, apply filters and blocks as indicators emerge – and make sure to only download software from official sites and trusted sources as malicious sites and mimicked sources have become a more and more common way to distribute such malware.

Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.

More from Tom's Guide

Network
Arrow
Intego
McAfee
Contract Length
Arrow
Showing 4 of 4 deals
Filters☰
Arrow
Intego
Mac Premium Bundle
View
58% off 1st yr
Norton
Norton 360 Deluxe 5D
$119.99
View
McAfee
McAfee+ Premium - Unlimited Devices
View
McAfee
McAfee+ Premium - Unlimited Devices
View
Amber Bouman
Amber Bouman
Senior Editor Security

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps. 

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.