Hackers are using a brand new tool to disable antivirus programs installed on devices, before deploying more dubious malware, and sometimes even ransomware, researchers have warned.
Cybersecurity researchers from Sophos X-Ops recently observed threat actors using the Bring Your Own Vulnerable Driver (BYOVD) method to deploy a tool called AuKill, capable of disabling security programs.
First, they need to drop a legitimate but vulnerable driver, onto the target endpoint. This is usually done through email-borne attacks, distributing the driver via phishing emails. The driver, capable of running with kernel privileges, is called procexp.sys, and is usually delivered next to the actual one, used by Microsoft’s Process Explorer v16.32 (a legitimate program that collects data on active Windows processes).
Bring Your Own Vulnerable Driver
Once the legitimate program runs the malicious DLL, it will first check to see if it’s running with SYSTEM privileges, and make sure it does, by posing as the TrustedInstaller Windows Modules Installer. Then, it starts multiple threads, testing and disabling various security processes and services.
After disabling security programs on the computer, AuKill’s operators will deploy stage-two malware. As per Sophos X-Ops’ report, sometimes threat actors will deploy the Medusa Locker, or LockBit – both extremely potent and popular ransomware variants.
“The tool was used during at least three ransomware incidents since the beginning of 2023 to sabotage the target's protection and deploy the ransomware,” the researchers warned. “In January and February, attackers deployed Medusa Locker ransomware after using the tool; in February, an attacker used AuKill just prior to deploying Lockbit ransomware.”
While the tool seems relatively new and was just spotted, one of its variants carries a November 2022 timestamp. The newest version discovered was compiled in mid-February, the researchers conclude. Its code is similar to that of Backstab, an open-source tool also capable of disabling antivirus programs. Researchers have seen LockBit’s operators deploy Backstab in the past.
“We have found multiple similarities between the open-source tool Backstab and AuKill,” the Sophos team says. “Some of these similarities include similar, characteristic debug strings, and nearly identical code flow logic to interact with the driver.”
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba