Cybersecurity researchers have uncovered a Bring Your Own Vulnerable Driver (BYOVD) campaign that uses a signed Avast driver to disable security defenses and seize control of infected systems.
According to Trellix security researcher Trishaan Kalra, the malware employs a legitimate Avast Anti-Rootkit driver (aswArPot.sys), manipulating it to disable protective software and terminate critical processes.
Attack Details
Initial Infection:
The attack starts with an executable file named kill-floor.exe, which:
- Drops the Avast Anti-Rootkit driver onto the target system.
- Registers the driver as a service using Service Control (sc.exe).
Kernel-Level Exploitation:
Once activated, the driver grants kernel-level access, allowing the malware to:
- Terminate 142 processes, including antivirus and EDR tools.
- Take snapshots of running processes and match them against a hard-coded list for termination.
This exploitation bypasses tamper protection mechanisms, as kernel-mode drivers can override user-mode protections effortlessly.
Increasing Prevalence of BYOVD Attacks
BYOVD has emerged as a favored method among cybercriminals due to its ability to exploit signed but vulnerable drivers, bypassing security measures to:
- Disable antivirus protections.
- Deploy ransomware and other malicious payloads.
Notably, in May 2024, Elastic Security Labs disclosed a GHOSTENGINE campaign that also leveraged the Avast driver for disabling security processes.
Unknowns and Implications
- Initial Access Vector: The method used to deliver the initial payload remains unclear.
- Scope of Impact: The scale of this campaign and its specific targets are yet to be determined.
This campaign underscores the importance of addressing vulnerabilities in signed drivers and improving tamper-proofing measures within antivirus and EDR solutions.
