Akira Ransomware Hijacks Intel Driver: A Comedy of Errors in Cybersecurity
Akira ransomware is turning Microsoft Defender into its unwitting accomplice by exploiting the rwdrv.sys driver from ThrottleStop. This clever BYOVD attack has Microsoft Defender singing lullabies instead of defending computers. Brace yourself, SonicWall VPN users, because Akira’s got its eyes on you too!
Hot Take:
When life gives you lemons, make lemonade. And when ransomware gives you a legitimate driver, turn it into a malicious exploit! Akira ransomware is turning the tables on Microsoft Defender by using Intel’s CPU tuning driver for their dastardly deeds. It’s like using a butter knife to rob a bank—unexpected, but apparently effective!
Key Points:
- Akira ransomware is using Intel’s ‘rwdrv.sys’ driver to disable Microsoft Defender.
- The attack involves a ‘Bring Your Own Vulnerable Driver’ (BYOVD) tactic.
- Guidepoint Security has provided a YARA rule and indicators of compromise (IoCs) for detection.
- Akira has been linked to attacks on SonicWall VPNs, possibly exploiting a zero-day vulnerability.
- Attackers use the Bumblebee malware loader, trojanized MSI installers, and multiple backdoor tools.
Already a member? Log in here