Turning Trusted Drivers Into Weapons
Introduction
Bring Your Own Vulnerable Driver (BYOVD) represents the most prevalent EDR-killing technique in ransomware operations during 2025–2026. Attackers deploy legitimate, Microsoft-signed kernel drivers with known vulnerabilities onto target systems. Windows trusts these drivers by default due to valid signatures. The attacker exploits the driver’s vulnerability to obtain Ring 0 privileges and terminates any process including EDR agents.
The Industrialization of EDR Killing
BYOVD has evolved from academic research to a commercial market with dashboards, credit balances, and vendor-vetted tools. A 2026 analysis identified 54 distinct tools circulating across underground forums, collectively abusing 35 signed, legitimate Windows drivers. The supply chain operates commercially: threat actors browse forum threads, transact through escrow, and receive operational tools within hours.
Underground Pricing (2026):
VoidKiller costs $300 for the base version, covering 50+ consumer AV products with enterprise EDR support for CrowdStrike and SentinelOne available as a premium add-on.
NtKiller costs $500 for the core functionality, which includes HVCI and VBS support. Additional modules include a rootkit component for $300, UAC bypass for $300 and Cobalt Strike integration.
GentleKiller: A Case Study in Industrialized BYOVD
The Gentlemen ransomware-as-a-service operation represents the current state of the art. Since emerging in March 2025, the group has claimed 504 victims with most located in Southeast Asia, South America, and Western Europe. The group is led by Alexander Andreevich Yapaev (aka hastalamuerte, zeta88), a 36-year-old Russian national and former Qilin affiliate.
What Sets Gentlemen Apart
Most RaaS operators leave affiliates to find their own EDR-killing tools. Gentlemen centralizes this function, offering affiliates a ready-to-use, standardized EDR-killer suite materially lowering the entry barrier.
GentleKiller is an in-house framework with at least eight distinct variants. Each variant impersonates a different legitimate product and abuses a different vulnerable or malicious driver:
VARIANT ABUSED DRIVER IMPERSONATED PRODUCT
──────────────────────────────────────────────────────────────────────────
Kaspersky eb.sys Kaspersky rootkit PoC
FACEIT nseckrnl.sys NSecsoft NSecKrnl
Valorant GameDriverX64.sys Valorant anti-cheat
Javelin stpm_old.sys/stpm_new.sys Safetica ProcessMonitor
WatchDog dmx.sys Zemana WatchDog Antimalware
Network Blocker 360netmon_wfp.sys Qihoo 360
Cleaner IMFForceDelete.sys IObit ForceDelete
G11 PoisonX.sys PoisonX rootkit
Across all variants, GentleKiller hunts for over 400 processes belonging to 48 distinct security products, including CrowdStrike, SentinelOne, Microsoft Defender, Sophos, Carbon Black, and ESET itself.
The Speed of Adaptation: The Gentlemen operators integrate abused drivers into their toolset within days of a BYOVD proof-of-concept being publicly disclosed.
Third-Party Tools Integrated:
HexKiller (googleApiUtil64.sys) — previously exclusive to Warlock ransomware
ThrottleBlood (ThrottleBlood.sys) — seen in MedusaLocker and DragonForce attacks
HavocKiller (havoc.sys) — publicly disclosed by Huntress in March 2026, already active in Gentlemen intrusions dating back to January 23.
Unified Evasion Strategy:
Gentlemen applies a standardized defense-evasion layer to all EDR killers:
- Advanced binary protection (Enigma or Themida)
- Filenames impersonating security vendors
- Fabricated version information
- Copied legitimate certificates and icons
The Technical Attack Chain
The attack follows a consistent five-stage pattern:
Loader Execution: The EDR killer arrives as a small loader, often dropped after initial access. Some samples require a 64-character password before execution to gate against sandbox analysis.
Vulnerable Driver Drop: The loader carries a legitimate Microsoft-signed driver embedded in its .data section, writes it to disk, and installs it as a service.
Kernel Exploitation: The loader interacts with the driver through DeviceIoControl calls. Each driver exposes IOCTLs that allow arbitrary kernel reads, writes, or direct process termination.
EDR Termination: Once kernel privileges are confirmed, the killer enumerates a hardcoded list of EDR processes, services, and drivers and tears each one down.
Pre-Encryption Runway: The window from agent disable to file encryption is frequently under 60 minutes.
Defensive Playbook: What Security Teams Should Do Now
Immediate Actions:
- Enable HVCI or Hypervisor-Protected Code Integrity which verifies kernel code pre-execution and enforces Microsoft’s driver blocklist. HVCI is enabled by default on Windows 11 22H2 and later, but it is frequently disabled. Audit and re-enable this control.
- Implement tamper protection through console-side policy enforcement not per-host configuration. Telemetry should stream off-host with sub-minute latency. Events already off-endpoint remain inaccessible to the killer.
- Deploy Windows Defender Application Control or WDAC, which shifts the security posture from a blocklist to a strict allowlist for kernel-mode code. This eliminates the BYOVD step entirely.
- Monitor service termination spikes: if 20 or more endpoints lose EDR agents within minutes treat this as an incident and not a configuration glitch.
- Utilize LOLDrivers.io or BYOVDFinder to cross-reference loaded drivers against known vulnerable driver databases. Microsoft’s blocklist lags behind new discoveries by weeks to months. Use these tools as a baseline not a perimeter.
Known Vulnerable Drivers (2025–2026):
DRIVER SOURCE KNOWN ABUSE
──────────────────────────────────────────────────────────────────────────
RTCore64.sys MSI Afterburner BlackByte, Scattered Spider,
RansomHub
zamguard64.sys Zemana RansomHub (EDRKillShifter),
Play, BianLian
procexp152.sys Microsoft Sysinternals AuKill, Medusa
iqvw64e.sys Intel Scattered Spider
mhyprot2.sys miHoYo (Genshin Impact) Documented abuse
ktapi.sys Kontron Zero-day used by The Gentlemen
MITRE ATT&CK Mapping
Privilege Escalation — T1068: Exploitation for Privilege Escalation
Attackers exploit a vulnerability in a legitimate, signed Windows driver to elevate privileges from user mode to kernel mode (Ring 0). This shift grants unrestricted access to system memory, hardware, and security primitives. Once at kernel level, attackers can manipulate core operating system functions, bypass user-mode security checks and disable protections without triggering the alerts that typically accompany administrative actions. The driver remains trusted by Windows because of its valid signature, allowing the exploit to execute without raising immediate suspicion.
Defense Evasion — T1562.001: Impair Defenses: Disable or Modify Tools
With kernel privileges established, attackers systematically terminate EDR processes. Primary targets include:
- MsMpEng.exe — Microsoft Defender Antivirus
- SenseNdr.exe — Microsoft Defender for Endpoint
Once terminated, these security products can no longer monitor system activity, generate alerts or initiate response actions. The attacker operates in a visibility blind spot, free to execute further malicious activity without defensive oversight.
Defense Evasion — T1489: Service Stop
Attackers go beyond process termination by stopping security-related services entirely. This action:
- Halts service threads that monitor system activity
- Removes kernel-mode hooks that EDR relies on for visibility
- Disrupts telemetry collection and forwarding to SIEM or SOAR platforms
With services stopped, security tools cannot automatically restart or recover. The attacker effectively disables the defensive layer at its core, preventing any residual monitoring or response capability.
Defense Evasion — T1211: Exploitation for Defense Evasion
Attackers exploit driver vulnerabilities not just for privilege escalation, but specifically to bypass security controls. Vulnerable drivers operate with kernel privileges and are implicitly trusted by Windows. By exploiting these flaws, attackers circumvent the entire security model that EDR relies upon and not merely terminating processes but undermining the foundational trust and integrity mechanisms that defensive tools depend on.
Defense Evasion — T1014: Rootkit
Finally, attackers deploy rootkits to establish persistent, hidden access at the kernel level. Once implanted, the rootkit:
- Hides processes, files, and registry keys from user-mode detection tools
- Hides network connections and system artifacts
- Ensures the attacker’s foothold remains invisible even if the initial EDR killer is detected and removed
This persistence mechanism allows attackers to maintain long-term access while remaining undetected by standard forensic and monitoring tools.
Conclusion
BYOVD is no longer a theoretical technique. It is the standard pre-encryption step for ransomware groups productized and sold on underground forums with support tiers and escrow payments. Relying on EDR alone is no longer sufficient. Defense must shift to a prevention-first model with layered, overlapping controls. HVCI and WDAC eliminate the driver-loading step by enforcing strict allowlists for kernel-mode code. Tamper protection must be enforced at the console level with sub-minute telemetry streaming, ensuring that events are off-host before they can be killed. Behavioral monitoring for service termination spikes turns the attacker’s pre-encryption activity into a detection signal rather than a black box.
References
ESET Research. “Killing me gently: Inside Gentlemen’s EDR killer framework.” WeLiveSecurity, June 2026. https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/
The Hacker News. “The Gentlemen RaaS Uses GentleKiller EDR Framework.” June 2026. https://thehackernews.com/2026/06/the-gentlemen-raas-uses-gentlekiller.html?m=1&hl=en_GB
Security Affairs. “Inside GentleKiller: The EDR-Killer Powering The Gentlemen.” June 2026. https://securityaffairs.com/193941/malware/inside-gentlekiller-the-edr-killer-powering-the-gentlemen.html
BlackFog. “How EDR Killers Work: BYOVD, Kernel Access, And The Pre-Encryption Window.” July 2026. https://www.blackfog.com/how-edr-killers-work/
threatER. “Your EDR Is the First Thing Ransomware Kills: BYOVD Explained.” May 2026. https://www.threater.com/blog/your-edr-is-the-first-thing-ransomware-kills/
Druva. “Weaponizing Trust: How BYOVD Tactics Silently Bypass EDR Defenses.” April 2026. https://www.druva.com/blog/weaponizing-trust-byovd
Expel. “Analyzing a zero-day exploit used by The Gentlemen ransomware.” June 2026. https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/?utm_source=thenextgentechinsider.com&utm_medium=referral&utm_campaign=post_article
Quarkslab. “BYOVD to the next level (part 2) — rootkit like it’s 2025.” October 2025. https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061_part2.html
Attack: BYOVD was originally published in System Weakness on Medium, where people are continuing the conversation by highlighting and responding to this story.