A security flaw has allowed a ransomware gang to effectively prevent antivirus programs from running properly on a system.
As reported by Bleeping Computer, the BlackByte ransomware group is utilizing a newly discovered method related to the RTCore64.sys driver to circumvent more than 1,000 legitimate drivers.
Security programs that rely on such drivers are therefore unable to detect a breach, with the technique itself being labeled as “Bring Your Own Driver” by researchers.
Once the drivers have been turned off by the hackers, they can operate under the radar due to the lack of multiple endpoint detection and response (EDR). The vulnerable drivers are able to pass an inspection via a valid certificate, and they also feature high privileges on the PC itself.
Researchers from cybersecurity company Sophos detail how the MSI graphics driver that is targeted by the ransomware gang offers I/O control codes that can be accessed through user-mode processes. However, this element breaches Microsoft’s security guidelines on kernel memory access.
Due to the exploit, threat actors can freely read, write, or execute code within a system’s kernel memory.
BlackByte is naturally keen to avoid being detected so as to not have its hacks analyzed by researchers, Sophos stated — the company pointed toward attackers looking for any debuggers running on the system and then quitting.
Furthermore, the group’s malware scans the system for any potential hooking DLLs connected to Avast, Sandboxie, Windows DbgHelp Library, and Comodo Internet Security. Should any be found by the search, BlackByte disables its ability to function.
Because of the sophisticated nature of the technique used by the threat actors, Sophos warned that they will continue to exploit legitimate drivers in order to bypass security products. Previously, the “Bring Your Own Driver” method was seen being used by the North Korean hacking group Lazarus, which involved a Dell hardware driver.
Bleeping Computer highlights how system administrators can protect their PCs by putting the MSI driver (RTCore64.sys) that is being targeted into an active blocklist.
BlackByte’s ransomware efforts first came to light in 2021, with the FBI stressing that the hacking group was behind certain cyberattacks on the government.
