After being notified by several security firms, Microsoft has revoked many signed drivers that had been leveraged by threat actors, in many cases by Chinese cybercriminals.
Signed drivers can be highly useful to threat actors, allowing them to gain complete control of an already-compromised system. These drivers can be used to manipulate system processes, evade endpoint security products, and maintain persistence on a system.
Cybersecurity firms often come across campaigns abusing signed drivers. In December 2022, for instance, Microsoft took action after SentinelOne, Mandiant and Sophos warned it that cybercriminals had been using signed malicious drivers to kill processes associated with security products.
Microsoft published an advisory at the time to inform users that drivers certified by its Windows Hardware Developer Program (WHDP) were being used by hackers with elevated privileges in post-exploitation activity. The company said activity was limited to the abuse of some developer program accounts and noted that its systems had not been compromised.
On Tuesday, the tech giant released a very similar advisory, this time crediting Sophos, Cisco and Trend Micro for informing it about the abuse of signed drivers.
“First reported by Sophos, and later Trend Micro and Cisco, Microsoft has investigated and confirmed a list of third-party WHCP-certified drivers used in cyber threat campaigns. Because of the drivers’ intent and functionality, Microsoft has added them to the Windows Driver.STL revocation list,” Microsoft said in an accompanying support document.
Sophos, Cisco and Trend Micro each published a blog post describing their findings on Tuesday.
Sophos identified 133 malicious drivers, including 100 signed with a Microsoft WHCP certificate. Many of the non-WHCP signed drivers were issued to Chinese companies.
Some of the drivers were used to kill endpoint security products, while others acted as rootkits, quietly running in the background. The rootkits included known families such as FU, Fivesys, FK_undead or Netfilter. Some of them allow attackers to bypass security features, such as the Windows User Account Controls (UAC) feature, on the compromised system.
Cisco’s blog post describes some of the open source tools abused by threat actors to change the signing date of kernel mode drivers, allowing them to load malicious drivers signed with expired certificates. The attackers are “taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015.”
One of the malicious drivers analyzed by Cisco, named RedDriver, has been used by Chinese cybercriminals to intercept the browser traffic of Chinese users.
Trend Micro has detailed a campaign involving a new signed rootkit believed to have been used by the threat actor that’s also behind the Fivesys rootkit.
“This malicious actor originates from China and their main victims are the gaming sector in China. Their malware seems to have passed through the Windows Hardware Quality Labs (WHQL) process for getting a valid signature,” the company said.
Related: Cybercrime Group Exploiting Old Windows Driver Vulnerability to Bypass Security Products
Related: Ransomware Operator Abuses Anti-Cheat Driver to Disable Antiviruses
Related: Iranian Hackers Using New Windows Kernel Driver in Attacks