Silent killers: unmasking a large-scale legacy driver exploitation campaign

Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign

Speakers: Jiří Vinopal, Threat Researcher, Check Point Research

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=ST4n5cADPbA

Overview

In the ever-escalating arms race between cyber defenders and attackers, the exploitation of vulnerable kernel-mode drivers has emerged as a particularly potent weapon. Jiří Vinopal, a Threat Researcher at Check Point Research, illuminated this critical attack vector in his talk, "Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign." This presentation peeled back the layers of a sophisticated, ongoing operation attributed to the notorious Chinese threat actor known as Silver Fox. The campaign, operating on a massive scale, leveraged thousands of unique variants of a decades-old, vulnerable driver to achieve arbitrary process termination, effectively disarming endpoint security solutions.

Vinopal's research not only exposed the sheer breadth of this campaign, involving hundreds of thousands of initial stage samples, but also meticulously detailed the ingenious techniques employed by the adversaries. These included abusing a Windows policy loophole for driver signing, bypassing Microsoft's vulnerable driver blocklist, and generating thousands of driver variants to evade traditional hash-based detections. The core objective: to pave the way for the deployment of the GhostRAT backdoor by neutralizing protected security processes. This talk serves as a stark reminder of the enduring threat posed by legacy vulnerabilities and the constant need for advanced hunting and detection mechanisms to stay ahead of determined adversaries.

Background

▶ Watch: Introduction: Why attackers exploit vulnerable drivers (0:00)

The exploitation of vulnerable drivers is not a new concept in the realm of advanced persistent threats, but its prevalence has surged in recent years. This resurgence is largely driven by Microsoft's continuous efforts to enhance Windows security, making it increasingly difficult for attackers to execute malicious code undetected from user mode. Consequently, adversaries have shifted their focus to the kernel, aiming to disarm the system before deploying their primary payloads. A key target in this strategy is the neutralization of Endpoint Detection and Response (EDR) solutions and other antivirus services, which often run as Protected Processes or Protected Processes Light. These processes are designed to resist conventional manipulation or termination from user mode, necessitating kernel-level access.

Attackers employ various methods to transform a vulnerable driver into an "EDR killer." While gaining a kernel write primitive offers broad capabilities, including unhooking mini-filter callbacks, it often escalates to more critical actions like elevation of privileges. A more common and equally effective approach, as highlighted in this research, involves abusing legitimate but powerful capabilities exposed by vulnerable drivers, such as the termination or suspension of arbitrary processes/threads, or the closing of arbitrary process handles. Closing all handles of a process inevitably leads to its termination.

This research was significantly inspired by Check Point's prior work, "Breaking Boundaries," which introduced mass hunting techniques for previously unknown vulnerable drivers. This methodology evolved into what Check Point Research terms a "future-focused hunting rule." This innovative approach adopts an attacker's mindset, proactively hunting for potential abuses of drivers that are not yet known to be vulnerable but possess characteristics that could make them attractive targets in the future. An example of such a rule for VirusTotal Live Hunt involves detecting new malicious files that install kernel drivers (e.g., via services registry keys) and crucially, filtering out samples dropping already known vulnerable drivers or those on Microsoft's blocklist, thereby focusing on novel threats. This proactive hunting rule was instrumental in uncovering the "Silent Killers" campaign.

Key Findings

▶ Watch: Discovery: 2.5K unique hashes for same driver version (7:00)

The application of Check Point's future-focused hunting methodology led to the unmasking of a sophisticated and large-scale exploitation campaign attributed to the Chinese threat actor Silver Fox. The investigation revealed that this campaign involved hundreds of thousands of distinct initial stage samples, with over a thousand specifically deploying an EDR kill module. A staggering discovery was the exploitation of more than 2,500 distinct variants of the legacy TrueSight driver, version 202. This particular version, despite an existing public Proof of Concept (PoC) for a newer vulnerable version (330), was not flagged as vulnerable in common detection mechanisms, making it a "silent killer."

The Silver Fox campaign demonstrated exceptional ingenuity in its evasion techniques:

1. Abuse of Windows Policy Loophole: The attackers leveraged a specific exception in Windows' driver signing policy, allowing them to load drivers signed with an end-entity certificate issued before July 29, 2015, and cross-signed by a supported certificate authority. This rendered their old, vulnerable driver loadable even on modern Windows 11 systems.
2. Bypass of Microsoft Vulnerable Driver Blocklist: While the TrueSight driver (specifically version 330) was present in Microsoft's blocklist, the Authenticode TBS hash for the legacy version 202 was conspicuously absent. This omission allowed the attackers to circumvent this critical built-in Windows protection.
3. Evasion of Hash-Based Detection: To counter traditional hash-based detection, the threat actors generated thousands of unique variants of the TrueSight 202 driver. They achieved this by subtly altering non-cryptographic parts of the Portable Executable (PE) structure—specifically the Optional Header Checksum and WIN_CERTIFICATE structure padding—without invalidating the digital signature.
4. Multi-Stage Infection and Final Payload: The campaign utilized a multi-stage infection chain, culminating in the deployment of an EDR kill module to disarm security solutions, followed by the installation of the well-known backdoor, GhostRAT (specifically identified as Hidden Ghost).

The infrastructure supporting this campaign primarily relied on public cloud services in China for hosting payloads and Command and Control (C2) servers. Victims were predominantly located in China (approximately 75%), with the remainder in other parts of Asia like Taiwan and Singapore, indicating a regionally focused but substantial operation.

Technical Deep Dive

▶ Watch: De-obfuscating VMProtect and recovering EDR killer logic (13:00)

The "Silent Killers" campaign employed a meticulously crafted, multi-stage infection process designed to achieve system compromise and persistence while evading detection.

Initial Infection Chain

The attack commenced with deceptive phishing techniques, often using fake websites like bank486[.]com or channels in popular messaging apps to lure victims into downloading the initial stage payload. This payload initiated a three-stage download and execution process:

• Stage 1: Downloader: A simple executable responsible for downloading Stage 2. Crucially, this stage did not establish persistence on the system.
• Stage 2: Encrypted Payloads & Driver Download: This stage acted as both a downloader and loader. It fetched encrypted payloads disguised to mimic common image file formats (e.g., PNG, JPEG) in their file extensions and even their initial bytes when viewed in a hex editor. More significantly, Stage 2 downloaded a variant of the legacy TrueSight driver, version 202. It then proceeded to download Stage 3.
• Stage 3: EDR Kill Module Deployment & GhostRAT Execution: This was the main operational stage. It loaded the encrypted payloads, deployed the EDR kill module, and, after successfully disarming security solutions, downloaded and executed the final payload: the GhostRAT backdoor, initiating C2 communication.

The encrypted payloads, whether from Stage 2 or 3, were never dropped to disk in their decrypted form. Instead, they were decrypted directly in memory and reflectively loaded. These decrypted payloads typically resulted in either 32-bit Portable Executables (PEs) or shellcode. A significant challenge for researchers was that any 32-bit PE payloads were protected by the latest version of VMProtect, a powerful commercial obfuscator.

Persistence Mechanisms

While Stage 1 lacked persistence, Stages 2 and 3 ensured their continued presence on infected systems through two primary methods:

1. Scheduled Task: The attackers created scheduled tasks with names designed to blend in with legitimate system processes, such as "Microsoft Edge update task UA." These tasks were configured to target a legitimate, digitally signed binary (e.g., APICalls.dll).
2. DLL Side-Loading: The malicious payload was executed through DLL side-loading. By placing a malicious DLL named APICalls.dll in a specific location, the scheduled task, when executed, would load this malicious DLL instead of a legitimate one, thereby executing the attacker's code.

EDR Kill Module Analysis and VMProtect Bypass

The EDR kill module, a 32-bit DLL deployed by Stage 3, was central to the campaign's success. Its primary function was to neutralize security solutions. Due to its protection by VMProtect, direct static analysis was initially daunting.

• Dynamic Analysis: Initial dynamic analysis quickly confirmed the module's core functionality: it utilized IOCTL 2244 to achieve arbitrary process termination. This IOCTL was known to exploit the vulnerability in the TrueSight driver.
• VMProtect Reconstruction: Despite the VMProtect obfuscation, Check Point researchers discovered that the EDR kill module was not fully protected. Only the entry point and exported functions were obfuscated. This partial protection likely stemmed from how the threat actors applied VMProtect: they likely applied it to an already compiled binary without debug symbols or map files. In such scenarios, VMProtect can only identify and protect well-defined entry points and exported functions, which have known virtual addresses.
• Custom Import Reconstruction: To overcome the VMProtect obfuscation and reconstruct the module's functionality, researchers employed a custom approach. After unpacking the binary (e.g., via debugging and memory dumping), they focused on reconstructing the Import Address Table (IAT), which VMProtect typically destroys. Standard tools for VMProtect reconstruction were often outdated or tailored for 64-bit binaries, necessitating a custom solution. This involved using IDA Pro, Python scripting, and the Box debugger (emulator). IDA's Box plugin allowed emulation of the IDA database, meaning a runnable sample wasn't strictly necessary. By automating emulation with IDA Python, they successfully reconstructed the imports.
• Main Logic Discovery: With the imports reconstructed, the module's core logic became clear. It contained a hardcoded list of 192 processes associated with security solutions. The module iterated through running processes, identified those on its kill list, and invoked the kill_process function, which in turn used IOCTL 2244 to terminate the target.
• Module Independence: An interesting finding was the EDR kill module's independence. Even though it was part of a multi-stage chain, it could function autonomously. If the vulnerable TrueSight driver wasn't already installed on the system, the EDR kill module would download, install, and load it itself before proceeding with its termination duties.

Legacy TrueSight Driver Exploitation

The choice of the TrueSight driver, version 202, was strategic. While a public PoC ("TrueSight Killer") existed for version 330, version 202 was a much older, legacy variant. The vulnerability (arbitrary process termination via IOCTL 2244) affected versions below 340, which was the patched version. The attackers exploited several facets of this legacy driver:

1. Windows Policy Loophole: The driver was not Microsoft-signed, but it bypassed strict driver signing policies due to an exception: its end-entity certificate was issued before July 29, 2015, and was cross-signed by a supported certificate authority. This allowed the driver to be loaded even on modern Windows 11 systems, effectively treating it as a legitimate legacy component.
2. Microsoft Vulnerable Driver Blocklist Bypass: Microsoft maintains a built-in protection mechanism, the vulnerable driver blocklist (enforced by WDE policy), which uses various attributes like original file name, version range, and Authenticode TBS hash to identify and block known vulnerable drivers. While the TBS hash for TrueSight version 330 was present in the blocklist, the hash for the legacy version 202 (e.g., 1D7E...) was missing. This omission allowed the Silver Fox campaign to load their vulnerable driver variants unimpeded.
3. Evasion of Hash-Based Detection: To create thousands of unique driver variants and thwart hash-based detections, the attackers cleverly modified specific, non-cryptographic parts of the PE file structure without invalidating the digital signature:

• PE Optional Header Checksum: They altered 4 bytes in the checksum field. The checksum is a non-critical field that does not affect the digital signature's validity.
• WIN_CERTIFICATE Structure Padding: The WIN_CERTIFICATE structure within a signed PE contains the attribute certificate entry, which includes the digital certificates. These certificates must be quad-word aligned (8-byte aligned). If not naturally aligned, they are padded with zero bytes. The attackers modified these zero-byte padding (4 bytes) without invalidating the signature, as this padding is outside the cryptographic data used for hashing.

Comparing the vulnerable TrueSight 202 with the patched version 340 revealed the simple fix: the patched version added a check to abort termination if the target process was running as a Protected Process, a safeguard entirely absent in the legacy variant.

Final Stage: GhostRAT

Across all analyzed samples, the final stage payload was consistently identified as GhostRAT, a well-known backdoor with publicly available source code. This open-source nature has led to dozens of variants, often rebranded by different threat groups. GhostRAT is predominantly used by Chinese threat actors. Typical routines include detecting analysis tools and retrieving new C2 addresses from remote URLs. The definitive identification of GhostRAT, specifically the "Hidden Ghost" variant, was achieved by decrypting and analyzing its custom network protocol, which often employs simple XOR, ADD, or SUB operations.

Demo / Proof of Concept

▶ Watch: Evading hash-based detection with PE modifications (22:00)

While the talk did not feature a live, interactive demonstration, the speaker referenced and confirmed key elements that serve as functional proof of concept. The existence of a public TrueSight Killer PoC on GitHub, which exploits version 330 of the driver, provided a foundational understanding of the vulnerability. Check Point's dynamic analysis of the EDR kill module unequivocally confirmed the usage of IOCTL 2244, the specific call that triggers the arbitrary process termination within the TrueSight 202 driver. The successful reconstruction of the VMProtected EDR kill module further validated the technical feasibility of their analysis and the inherent vulnerability.

Defensive Implications

▶ Watch: GhostRAT final stage and mitigation recommendations (26:00)

The "Silent Killers" campaign highlights several critical implications for defenders:

1. Ineffectiveness of Hash-Based Detection: The generation of thousands of unique driver variants by altering non-cryptographic PE fields renders traditional hash-based detection mechanisms largely ineffective. Defenders must move beyond simple hash blacklisting for critical components like drivers.
2. Reliance on Authenticode File Hash: Instead of file hashes, defenders should prioritize using Authenticode file hashes (specifically, the TBS hash of the certificate itself) for driver identification and blocking. These hashes remain constant even if the PE checksum or padding is modified, as they relate to the digital signature, not the mutable parts of the PE structure.
3. Proactive Blocklist Management: The bypass of Microsoft's vulnerable driver blocklist for TrueSight 202 underscores the need for continuous and proactive updates. While Windows automatically updates the blocklist, these updates are infrequent (typically once or twice a year). Organizations should manually apply the latest versions of the blocklist to ensure comprehensive protection.
4. Future-Focused Threat Hunting: The success of Check Point Research's "future-focused hunting rule" demonstrates the value of adopting an attacker's mindset. Proactively identifying and monitoring drivers with capabilities that could be abused, even if not yet publicly known as vulnerable, can provide an early warning against emerging threats.
5. Reporting and Collaboration: Check Point Research's swift reporting of the blocklist bypass to the Microsoft Security Response Center (MSRC) resulted in an immediate update to the vulnerable driver blocklist. This collaboration is crucial for strengthening ecosystem-wide defenses.
6. Enhanced Behavioral Detection: Given the sophistication of these attacks, EDR and other security solutions must evolve to detect behavioral patterns (e.g., unusual driver installations, attempts to terminate protected processes, specific IOCTL calls, or the loading of VMProtected modules) rather than relying solely on static signatures.

Key Takeaways

• Legacy Vulnerabilities Persist: Old, unpatched drivers, especially those signed under older policies, remain viable and potent attack vectors, capable of bypassing modern security features.
• Sophisticated Evasion: Threat actors like Silver Fox employ advanced techniques, including digital signature manipulation and blocklist bypasses, to circumvent conventional defenses.
• Hash-Based Detection Limitations: Traditional file hashing is insufficient against polymorphic driver variants; Authenticode file hashes offer a more robust alternative.
• Proactive Threat Hunting is Essential: Adopting an attacker's mindset and using "future-focused hunting rules" can help uncover large-scale campaigns exploiting previously unblocked vulnerabilities.
• Multi-Stage Attacks are Standard: Complex infection chains, often involving encrypted payloads and obfuscation (e.g., VMProtect), are used to deliver final-stage backdoors like GhostRAT.
• Collaboration is Key: Reporting critical findings to vendors like Microsoft is vital for rapid remediation and strengthening collective defenses against widespread threats.

About the Speaker(s)

Jiří Vinopal is a Threat Researcher at Check Point Research. His primary specializations include reverse engineering, malware research, and the dissection of advanced threats. His work focuses on uncovering and analyzing sophisticated attack campaigns, particularly those involving low-level system exploitation and evasion techniques.