Malware News Qilin ransomware deploys sophisticated multi-stage EDR killer targeting 300+ security products.

[Khushal]

Content source

https://blog.talosintelligence.com/qilin-edr-killer/

Advanced loader uses SEH/VEH-based obfuscation and kernel manipulation to completely disable endpoint detection systems.
Technical breakdown:
• Stage 1: Malicious msimg32.dll side-loaded via DLL hijacking, implements slot-policy table for syscall evasion and Halo's Gate technique
• Stage 2-3: Complex VEH-based control flow obfuscation, overwrites ExitProcess IAT entry, maps payload into shell32.dll memory space
• Stage 4: EDR killer loads rwdrv.sys (abused ThrottleStop driver) for physical memory R/W, hlpdrv.sys for process termination (T1562.001)
• Kernel manipulation: Unregisters EDR callbacks for process/thread/image events, overwrites CiValidateImageHeader with ArbPreprocessEntry
• Geo-fencing excludes post-Soviet countries, requires admin privileges for driver loading

Attack chain systematically blinds behavioral detection before ransomware deployment.

Qilin EDR killer infection chain

This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems.

blog.talosintelligence.com

 

[Divergent]

Executive Summary

Confirmed Facts
The Qilin ransomware affiliates are deploying a sophisticated multi-stage loader via "msimg32.dll" that utilizes a Bring Your Own Vulnerable Driver (BYOVD) attack to terminate over 300 EDR products.

Assessment
Because the malware explicitly targets kernel-level EDR callbacks using "rwdrv.sys" (CVE-2025-7771), the initial access vector is unknown, but execution strictly requires local Administrator privileges to load the driver.

Technical Analysis & Remediations

MITRE ATT&CK Mapping

T1574.002
Hijack Execution Flow: DLL Side-Loading (via msimg32.dll).

T1068
Exploitation for Privilege Escalation (BYOVD).

T1562.001
Impair Defenses: Disable or Modify Tools.

CVE Profile
CVE-2025-7771
(ThrottleStop rwdrv.sys IOCTL vulnerability)
[NVD Score: High]
[CISA KEV Status: Active]

Telemetry

File Names / API Calls
"msimg32.dll"
"rwdrv.sys"
"hlpdrv.sys"
"ExitProcess"
"ntdll!LdrProtectMrdata"

Constraint
The delivery vector is entirely missing from the provided telemetry; therefore, the origin is classified as Insufficient Evidence. The structure resembles a highly targeted ransomware precursor stage designed solely to blind behavioral detection prior to encryption.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Ensure security policies strictly prohibit the loading of unsigned or explicitly blocklisted vulnerable drivers (e.g., ThrottleStop components) across the enterprise environment.

DETECT (DE) – Monitoring & Analysis

Command
Deploy SIEM alerts for DLL side-loading anomalies involving "msimg32.dll" and monitor Event Tracing for Windows (ETW) for unexpected suppression or tampering.

Command
Hunt for the presence of "rwdrv.sys" or "hlpdrv.sys" executing from %TEMP% or non-standard directories.

RESPOND (RS) – Mitigation & Containment

Command
Isolate any endpoint immediately where EDR telemetry abruptly ceases, as blinding the defense layer is the primary objective of this specific infection chain.

RECOVER (RC) – Restoration & Trust

Command
Validate system integrity by confirming the absence of unauthorized kernel callbacks and verifying EDR agent health before reintroducing the endpoint to the network.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Implement Microsoft Defender Application Control (WDAC) with the Microsoft Vulnerable Driver Blocklist enabled to categorically prevent CVE-2025-7771 exploitation.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately if your security software unexpectedly disables itself or reports that it cannot start. (Note: The attacker must already have administrator access to your machine for this attack to work).

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords/MFA using a known clean device (e.g., phone on 5G) if a ransomware infection is suspected.

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions. Ensure no rogue applications are persistently side-loading the malicious "msimg32.dll".

Hardening & References

Baseline
CIS Benchmarks (Ensure standard user accounts do not have the administrative privileges required to load drivers).

Framework
NIST CSF 2.0 / SP 800-61r3.

Source

Talos Intelligence Blog

NIST Cybersecurity Framework (CSF) 2.0

NIST Special Publication 800-61 Revision 3

MITRE ATT&CK Framework

CIS (Center for Internet Security)

 

[Andy Ful]

The DLL loader is unsigned, so Smart App Control should also block this DLL. However, SAC could be bypassed when the attackers use a signed version of the DLL.

 

[Parkinsond]

The loader also implements geo-fencing. It excludes systems configured for languages commonly used in post-Soviet countries. This check is performed at an early stage, and the loader terminates if a locale from the exclusion list is detected.

The creator is Russian.

The DLL loader is unsigned, so Smart App Control should also block this DLL. However, SAC could be bypassed when the attackers use a signed version of the DLL.

This man is signing each single piece:

The “rwdrv.sys” driver is a renamed version of “ThrottleStop.sys”, originally distributed by TechPowerUp LLC and signed with a valid digital certificate. It is legitimately used by tools such as GPU-Z and ThrottleStop. This is not the first observed abuse of this ; it has previously been leveraged in several malware campaigns.

 

[Divergent]

The remediation strategy outlined above specifically, implementing the Microsoft Vulnerable Driver Blocklist, provides a vastly superior and more resilient defense for both Enterprise and Home environments. While reputation-based systems like Smart App Control (SAC) serve as a useful baseline, threat actors routinely bypass them using stolen or purchased digital certificates. In contrast, enforcing the driver blocklist at the kernel level (via WDAC or Memory Integrity) structurally severs the BYOVD attack chain. Even if an adversary successfully subverts SAC, they are fundamentally denied the ability to load the malicious driver required to blind your system defenses.

 

[Andy Ful]

This man is signing each single piece:

But not the initial DLL. The first driver is a legal kernel driver signed by a legal company. The second driver is unsigned and probably not a kernel driver.

Post corrected.
It seems that the second driver is also a kernel driver loaded by the malware at the final infection stage. As far as I understand, it was loaded by the first (legally signed driver) to bypass the driver signing enforcement on Windows 10+ 64-bit.

 

[Parkinsond]

But not the initial DLL. The first driver is a legal kernel driver signed by a legal company. The second driver is unsigned and probably not a kernel driver.

It requires only one unsigned executable (exe/dll) to be caught by SAC/WDAC.

 

[Andy Ful]

It requires only one unsigned executable (exe/dll) to be caught by SAC/WDAC.

Yes, at the initial infection stage. At a later stage, the block can often be insufficient to stop all malicious actions.

Edit.
Why was the DLL unsigned? It was most probably sufficiently effective.

 

[Andy Ful]

The interesting method in this attack is using two drivers (a legally signed and an unsigned malicious). This can bypass the Microsoft Vulnerable Driver BlockList when the first driver is not on the BlockList. The first driver does not have to be vulnerable (not exploited, but rather abused).
However, such drivers are most probably blocked by Core Isolation.

 

[Parkinsond]

However, such drivers are most probably blocked by Core Isolation.

or by "Block abuse of exploited vulnerable signed drivers" if it is a part of installation process.

 

[Andy Ful]

or by "Block abuse of exploited vulnerable signed drivers" if it is a part of installation process.

If I correctly understand the logic of the attack, the first driver may be non-vulnerable, but it has some legal functions that can be used in the attack.
A similar situation is with LOLBins. Most of them are not exploited but abused by the attackers.
Userland analogy = PowerShell + malicious script ---> Constrained Language Mode restricts actions in PowerShell.
Kernel analogy = Legal Signed Driver + malicious unsigned driver ---> Core Isolation restricts Driver actions in the Kernel.

 

[Andy Ful]

The first driver (rwdrv.sys) is included on the current WDAC Microsoft Recommended Vulnerable Driver Blocklist:
<FileAttrib ID="ID_FILEATTRIB_GPUZ" FriendlyName="GPUZ.sys\7b1529da3469a46d738a20b98e49f78e1b24aed34a62ea5440db78ccda73e972 FileAttribute" ProductName="Low-Level Driver" MinimumFileVersion="0.0.0.0" MaximumFileVersion="65535.65535.65535.65535"/>

The file hash 7b1529da3469a46d738a20b98e49f78e1b24aed34a62ea5440db78ccda73e972 is related to another variant of the driver, but the rule identifies those drivers by FileAttribute "ProductName="Low-Level Driver". As can be seen on VirusTotal, the rwdrv.sys driver has the same ProductName.
It is most probable that the MD ASR rule can also block this driver. However, the Windows built-in blocklist is outdated (April 2025 on my Windows 11 25H2) and may not block it.
There is an article from August 2025 about POC that uses this driver to compromise the kernel. Bearing in mind how sophisticated the malware is, it most probably could bypass Windows built-in blocklist at the time of attacks in the wild. For extended security, Microsoft recommends compiling the current WDAC block list and using it alongside the Windows built-in one.

 

[Andy Ful]

The difference between exploiting and abusing is fragile, as can be seen from this article:

The “rwdrv.sys” driver is a renamed version of “ThrottleStop.sys”, originally distributed by TechPowerUp LLC and signed with a valid digital certificate. It is legitimately used by tools such as GPU-Z and ThrottleStop. This is not the first observed abuse of this ; it has previously been leveraged in several malware campaigns.

Despite its benign origin, the driver exposes highly powerful functionality and can be loaded by arbitrary user-mode applications. Critically, it implements these capabilities without enforcing meaningful security checks, making it particularly attractive for abuse.

The driver is not vulnerable due to the possibility of forcing errors in the code flow, which can be exploited. However, running it makes the kernel vulnerable to attacks from Userland.

 

[Parkinsond]

The difference between exploiting and abusing is fragile, as can be seen from this article:


The driver is not vulnerable due to the possibility of forcing errors in the code flow, which can be exploited. However, running it makes the kernel vulnerable to attacks from Userland.

Vulnerability-creating invulnerable driver.