Ransomware Group Blinds EDR Using Signed Anti-Cheat Driver in New Kernel-Level Attack

Incident Analysis Report

Threat: Interlock Ransomware – “Hotta Killer” BYOVD EDR Bypass
Date Observed: February 4
Platforms Impacted: Windows endpoints and servers

Overview

This incident involved a ransomware intrusion where attackers deliberately disabled endpoint security before deploying encryption payloads. The threat actor used a technique known as Bring Your Own Vulnerable Driver (BYOVD) to gain kernel-level control over the system and terminate protected Endpoint Detection and Response (EDR) processes.

The method centers on abusing a legitimate but vulnerable anti-cheat driver that is digitally signed and therefore trusted by Windows. Once loaded, the driver was controlled by a custom user-mode tool (internally referred to as Hotta Killer) to shut down security products at the kernel level, bypassing tamper protection and self-defense mechanisms.

After security controls were neutralized, the attackers moved laterally, staged ransomware payloads, and encrypted systems with minimal resistance.

What Happened

Attackers gained access to the environment, elevated privileges to local administrator, and installed a vulnerable kernel driver. This driver allowed arbitrary process termination from kernel space. Using a custom controller tool, the attackers killed EDR and antivirus processes that normally cannot be stopped by user-mode malware.

With defenses disabled, ransomware was deployed across affected systems, resulting in widespread encryption and operational disruption.

How the Attack Worked

1. Initial Access

The intrusion began with access to a Windows endpoint using one of the following commonly observed methods associated with Interlock activity:

Phishing email leading to credential theft
Use of previously compromised VPN or RDP credentials
Exploitation of exposed remote services
Reuse of administrator credentials from another compromised system

At this stage, access was limited and did not include kernel or SYSTEM-level privileges.

2. Privilege Escalation

To install a kernel driver, the attackers first escalated privileges to local administrator. Evidence indicates this was achieved through:

Credential dumping from memory
Abuse of weak local admin password hygiene
Token impersonation from a privileged process

Once administrative access was confirmed, the attackers transitioned to defense evasion.

3. Vulnerable Driver Deployment (BYOVD)

The attackers dropped a legitimate anti-cheat driver onto disk. The driver was digitally signed and therefore passed Windows driver signature enforcement.

The vulnerability (CVE-2025-61155) allows unsafe IOCTL calls that can be abused to terminate arbitrary processes without restriction. This includes protected system services and security products.

The driver was installed as a kernel service and loaded into memory.

4. “Hotta Killer” Execution

A custom executable was launched to interface with the driver. This tool performed the following actions:

Opened a handle to the vulnerable driver
Enumerated running processes
Identified known EDR, antivirus, and monitoring agents
Issued IOCTL commands instructing the driver to terminate those processes

Because termination occurred in kernel mode, EDR self-protection did not trigger.

5. Security Control Disablement

The following types of services were terminated:

EDR agents
Antivirus engines
Behavioral monitoring services
Endpoint telemetry collectors

In multiple cases, the attacker also disabled restart mechanisms, ensuring security tools remained offline.

At this point, the environment lost endpoint visibility.

6. Ransomware Operations

With security controls neutralized, the attackers:

Performed network discovery
Reused harvested credentials
Moved laterally using SMB and RDP
Copied ransomware payloads to additional systems
Deleted volume shadow copies and backups
Executed encryption payloads

Encryption occurred silently due to the absence of endpoint protection.

Payloads and Tools Used

Primary Components

Kernel Driver: Legitimate but vulnerable anti-cheat driver
Hotta Killer: Custom user-mode controller for driver abuse
Ransomware Binary: Interlock ransomware variant

Supporting Activity

Credential dumping utilities
Built-in Windows tools (cmd, PowerShell, sc.exe)
Admin shares for lateral movement

No exploit code was required beyond misuse of the driver’s exposed functionality.

Vulnerability Exploited

CVE-2025-61155
Vulnerable anti-cheat kernel driver
Unsafe IOCTL handlers allow arbitrary process termination
Used strictly for defense evasion, not initial access

Impact

EDR and antivirus disabled across multiple systems
Loss of security telemetry
Successful ransomware deployment
Business disruption due to encrypted endpoints and servers

Known Indicators of Compromise (IOCs)

File-Based IOCs

C:\Windows\Temp\hotta.exe
C:\ProgramData\hotta\hotta.exe
C:\Users\Public\hotta.exe
C:\Windows\System32\drivers\*.sys (recently written)

Driver Artifacts

C:\Windows\System32\drivers\ACE-*.sys
C:\Windows\System32\drivers\anti_cheat*.sys

Registry Indicators

HKLM\SYSTEM\CurrentControlSet\Services\ACE*
HKLM\SYSTEM\CurrentControlSet\Services\hotta*

Service Creation

Type: SERVICE_KERNEL_DRIVER
StartType: SYSTEM_START or DEMAND_START
ImagePath: \SystemRoot\System32\drivers\<random>.sys

Behavioral Indicators

EDR service stops without uninstall event
Security agents terminate within minutes of driver load
Endpoint stops reporting telemetry before encryption
Sudden kernel driver load followed by ransomware activity

Threat Hunting Queries

1. Hunt for Suspicious Driver Loads (Windows Event Logs)

Logic

DriverLoadEvent
AND DriverPath NOT IN approved_driver_list
AND EventTime within 10 minutes of EDR service stop

Key Fields to Review

Driver name
Driver path
Load timestamp
Signing certificate

2. Hunt for EDR Termination Patterns

Logic

ProcessTermination
WHERE ProcessName IN (EDR/AV process list)
AND TerminationSource != legitimate_uninstall

Look for:

No parent process
Kernel-mode termination
No service restart attempts

3. Hunt for Silent Hosts

Logic

Endpoint last_seen_time < now - 30 minutes
AND User logon activity exists
AND Network traffic exists

This identifies systems still active but no longer reporting telemetry.

4. Hunt for Driver Service Creation

Registry-Based Hunt

HKLM\SYSTEM\CurrentControlSet\Services\
WHERE Type = 1 (kernel driver)
AND CreationTime recent

5. Ransomware Precursor Activity

vssadmin delete shadows
wbadmin delete catalog
bcdedit /set {default} recoveryenabled no

These commands often follow EDR disablement.

Detection Rule Recommendations

Rule: BYOVD Defense Evasion

IF kernel driver is loaded
AND driver is not on allowlist
AND security service stops within 5 minutes
THEN alert as HIGH severity

Rule: Security Tool Kill Chain

IF EDR process terminated
AND no uninstall logged
AND kernel activity detected
THEN isolate endpoint

Defensive Recommendations

Enable Microsoft vulnerable driver blocklist
Enforce WDAC or HVCI for driver control
Alert on all kernel driver installations
Treat gaming and anti-cheat drivers as high risk
Monitor for security tool termination regardless of outcome
Correlate driver load + EDR stop as a single detection

Final Takeaway

This incident demonstrates a deliberate and effective approach to neutralizing modern endpoint defenses by abusing trusted kernel components rather than exploiting traditional malware weaknesses. By weaponizing a signed driver, the attackers bypassed security controls designed to stop ransomware before execution.

The attack highlights a growing trend where Windows kernel trust becomes the primary attack surface, making driver visibility and control critical for future defense.