Home » This devious malware is able to disable your antivirus

This devious malware is able to disable your antivirus

0 comment

Threat actors have found a way to disable antivirus solutions and other endpoint protection tools using an increasingly popular method.

Cybersecurity researchers from Sophos recently detailed how the method, known as called Bring Your Own Vulnerable Driver, works, and the dangers it brings to businesses around the world.

According to the company’s research, ransomware operators BlackByte are abusing a vulnerability tracked as CVE-2019-16098. It is found in RTCore64.sys and RTCore32.sys, drivers used by Micro-Star’s MSI AfterBurner 4.6.2.15658. Afterburner is an overclocking utility for GPUs, that gives users more control over the hardware.
Blocking the drivers

The vulnerability allows authenticated users to read and write to arbitrary memory, consequently leading to privilege escalation, code execution, and data theft – and in this case, helped BlackByte disable more than 1,000 drivers that security products need to run.

“Chances are good that they will continue abusing legitimate drivers to bypass security products,” Sophos said in a blog post outlining the threat.

To protect against this new attack method, Sophos suggests IT admins add these particular MSI drivers to an active blocklist and make sure they aren’t running on their endpoints. Furthermore, they should keep a close eye on all drivers being installed on their devices, and audit the endpoints regularly to look for rogue injections without a hardware match.

Read more

> Installing gaming drivers might leave your PC vulnerable to cyberattacks> Lazarus hackers target Dell drivers with new rootkit> Protect from threats with the best malware removal solutions

Bring Your Own Vulnerable Driver might be a new method, but its popularity is rising, fast. Earlier this week, a notorious North Korean state-sponsored threat actor Lazarus Group was observed using the same technique against Dell. Cybersecurity researchers from ESET have recently seen the group approach aerospace experts and political journalists in Europe with fake job offers from Amazon. They would share fake job description pdfs, which are essentially old, vulnerable Dell drivers.

What makes this technique particularly dangerous is the fact that these drivers aren’t malicious per se, and as such, are not flagged by antivirus solutions.

Here’s our list of the best firewalls right now

Via: BleepingComputer

Source: Read More

You may also like

Leave a Comment

CyberNonStop

Cybernonstop is created to bring news and knowledge through articles to visitors.

Do not forget to subscribe.

Laest News

@2021 – All Right Reserved. Designed and Developed by PenciDesign