Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

"The first stage consists of a PE loader responsible for preparing the execution environment for the EDR killer component. This secondary payload is embedded within the loader in an encrypted form."

"The DLL loader implements an array of techniques to evade detection. It neutralizes user-mode hooks, suppresses Event Tracing for Windows (ETW) event logs, and takes steps to conceal control flow and API invocation patterns."

"Prior to loading the second driver, the EDR killer component unregisters monitoring callbacks established by the EDR, ensuring that process termination can proceed without interference."

Qilin and Warlock ransomware operations employ the bring your own vulnerable driver (BYOVD) technique to disable security tools on compromised systems. Qilin attacks utilize a malicious DLL named 'msimg32.dll' to initiate a multi-stage infection chain targeting endpoint detection and response (EDR) solutions. This DLL can terminate over 300 EDR drivers from various vendors. The malware employs advanced evasion techniques, including neutralizing user-mode hooks and suppressing event logs, allowing it to execute undetected in memory. Two specific drivers are used to facilitate these attacks.

Read at The Hacker News