Qilin and Warlock ransomware exploit vulnerabilities on the driver.

Qilin and Warlock ransomware exploits vulnerabilities on the driver, shutting down more than 300 EDR tools.

Malware for victim ransom, or Ransomware, can be called a serious problem at the enterprise level. Organizations have to find the best way to prevent it because being attacked by ransomware is so serious that it can lead to the collapse of an entity. But even if they find the best way to prevent it, ransomware itself develops in time.

According to a report by The Hacker News website, a research team from famous networking tool developer Cisco Talos and cybersecurity tool developer Trend Micro has detected the EDR or End Point Detection and Response technique of a group of hackers behind Qilin and Warlock ransomware with their own weak version of the driver, or BYOVD (Bring Your Own Vulnerable Driver).

The method of Qilin ransomware is to implement a malware DLL file named "msimg32.dll," which is part of the multi-step embedding of the malware (Multi-Stages Infection), starting with the use of a loader named PE Loader, which will prepare the environment (environment) with the loading of its own DLL file, or a DLL Sideloading to unlock a malware file (load Payware) that acts as an EDR or EDR Killer closure tool from the PE Loader. This Loader has been used. Many techniques to prevent detection, such as using User-Mode Hooks, suppress Event Tracing for Windows (ETW) to prevent Event Log from being easily detected.

After decomposing the second payload file, which is both EDR Killer and two drivers that are shared, as follows:

The first will be a tool for closing the EDR Callback (a mechanism for monitoring suspicious events). It will work with a driver called rwdr.sys, which has been renamed "ThrottleStop.sys." This driver will be used to access memory at the hardware level (Physical Memory) in Kermel-Mode.

The second will disable the EDR process. It will work with a driver called hlpdrv.sys. This collaboration allows the malware to shut down up to 300 EDR tools.

Qilin malware is the number one most active ransomware attack, involving 22 of 134 ransomware attacks in 2025, which, when hit by up to 16.4% of all attacks. Qilin ransomware attacks are simple because it started with a stolen login password to place ransomware on the system.

While Warlock ransomware (also known as Water Manaul) has a more complex attack with the use of loopholes on Microsoft SharePoint servers that are not updated to invade the system, the Toolset will be updated to guarantee persistence on the system, evade detection, and continue to invade the Lateral Movement. In this case, tools like TVNC are used to help hackers who control ransomware access the system at any time, but vulnerable drivers are used. NSec drivers ("NSecKrnl.sys") to help shut down the Kernel-level protection system, which is also a BYOVD technique. In addition, several tools have been brought to assist in recent campaign operations, such as

PsExec for Lateral Movement

RDP Patcher is used to take control of the machine through the Remote Desktop Protocol or RDP.

Velociraptor is used in command and control or C2 (Command and Control).

Visual Studio Code and Cloudflare Tunnel are used as channels (tunnels) to contact the C2 server.

Yuze is used to penetrate intranet systems (Intranet) in the enterprise and is used to reverse Proxy back to the C2 server via port 80 (HTTP), port 443 (HTTPS), and port 53 (DNS).

Rclone is used to secretly export data (Exfiltration).

# Trending # Lemon 8 Howtoo # lemon 8 diary # Ransomware # freedomhack