Tag: drivers

2 Attack Reports | 0 Vulnerabilities

Attack reports

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Dr…

Published: August 8, 2025

Downloadable IOCs: 2

Kernel shellcode persistence technique in APT attacks and CTF challenge

A security flaw in Windows 7 and Server 2008 R2 allows kernel shellcode to be hidden in the registry and executed during boot, despite patches. This vulnerability was exploited in a 2018 targeted attack. The SAS CTF challenge involved analyzing this technique, which uses buffer overflows in DirectX…

buffer overflow

Published: October 17, 2024

Downloadable IOCs: 0

Click here to see more Attack Reports