Avastly Unprotected: Malware Exploits Old Driver to Wreak Havoc on Security Systems
A malware campaign cleverly hijacks the Avast Anti-Rootkit driver, aswArPot.sys, turning it into a stealthy tool for evildoers to evade detection and wreak havoc on security systems. It’s like giving a burglar the keys to your house—and then some. Talk about an unwanted software update!
Hot Take:
Who knew that an anti-rootkit driver could be the root of all evil? Avast’s once-trusted defender has turned rogue, proving that even security tools can have a mid-life crisis and start working for the bad guys. It’s like your antivirus software suddenly deciding to moonlight as a hacker. Talk about betrayal!
Key Points:
- Threat actors exploited a vulnerable Avast Anti-Rootkit driver to gain system control.
- The attack compromised multiple security products like Microsoft Defender, ESET, and Sophos.
- Malware gains kernel-level access, enabling termination of critical security processes.
- The tactic, known as BYOVD, uses flawed drivers for malicious purposes.
- Organizations are advised to deploy rules to block vulnerable drivers.
Already a member? Log in here