Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools Ravie LakshmananApr 06, 2026Ransomware / Endpoint Security Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver (BYOVD) technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have been found to deploy a malicious DLL named "msimg32.dll," which initiates a multi-stage infection chain to disable endpoint detection and response (EDR) solutions. The DLL, launched via DLL side-loading, is capable of terminating more than 300 EDR drivers from almost every security vendor in the market. "The first stage consists of a PE loader responsible for preparing the execution environment for the EDR killer component," Talos researchers Takahiro Takeda and Holger Unterbrink said. "This secondary payload is embedded within the loader in an encrypted form." The DLL loader implements an array of techniques to evade detection. It neutralizes user-mode hooks, suppresses Event Tracing for Windows (ETW) event logs, and takes steps to conceal control flow and API invocation patterns. As a result, it allows the main EDR killer payload to be decrypted, loaded, and executed entirely in memory while entirely flying under the radar. Once launched, the malware makes use of two drivers - rwdrv.sys, a renamed version of "ThrottleStop.sys" that's used to gain access to the system's physical memory and act as a kernel-mode hardware access layer. hlpdrv.sys, to terminate processes associated with over 300 different EDR drivers belonging to various security solutions. It's worth noting that both drivers have been used as part of BYOVD attacks carried out in conjunction with Akira and Makop ransomware intrusions. "Prior to loading the second driver, the EDR killer component unregisters monitoring callbacks established by the EDR, ensuring that process termination can proceed without interference," Talos said. "It demonstrates the sophisticated tricks the malware is employing to circumvent or completely disable modern EDR protection features on compromised systems." According to statistics compiled by CYFIRMA and Cynet, Qilin has emerged as the most active ransomware group in recent months, claiming hundreds of victims. The group has been linked to 22 out of 134 ransomware incidents that were reported in Japan in 2025, representing 16.4% of all attacks. "Qilin primarily relies on stolen credentials to gain initial access," Talos said. "After successfully breaching a target environment, the group places considerable emphasis on post-compromise activities, allowing it to methodically expand its control and maximize impact." The cybersecurity vendor also noted that ransomware execution occurred on average roughly six days after the initial compromise, highlighting the need for organizations to detect malicious activity at the earliest possible stage and to prevent the deployment of ransomware. The disclosure comes as the Warlock (aka Water Manaul) ransomware group continues to exploit unpatched Microsoft SharePoint servers, while updating its toolset for enhanced persistence, lateral movement, and defense evasion.This includes the use of TightVNC for persistent control and a legitimate-but-vulnerable NSec driver ("NSecKrnl.sys") in a BYOVD attack to terminate security products at the kernel level, replacing the "googleApiUtil64.sys" driver used in prior campaigns. Also observed during the course of the Warlock attack in January 2026 were the following tools - PsExec, for lateral movement. RDP Patcher, for facilitating concurrent RDP sessions. Velociraptor, for command-and-control (C2). Visual Studio Code and Cloudflare Tunnel, for tunneling C2 communications. Yuze, for intranet penetration and establishing a reverse proxy connection to the attacker's C2 server across HTTP (port 80), HTTPS (port 443), and DNS (port 53). Rclone, for data exfiltration. To counter BYOVD threats, it's recommendedto only allow signed drivers from explicitly trusted publishers, monitor driver installation events, and maintain a rigorous patch management schedule for updating security software, specifically those with driver-based components that could be exploited.  "Warlock's reliance on vulnerable drivers to disable security controls requires a multilayered defense focused on kernel integrity," Trend Micro said. "Thus, organizations must upgrade from basic endpoint protection to enforcing strict driver governance and real-time monitoring of kernel-level activities." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cybersecurity, endpoint security, Incident response, Kernel Security, Microsoft SharePoint, network intrusion, ransomware, Threat Intelligence Trending News FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks 54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks Google Adds 24-Hour Wait for Unverified App Sideloading to Reduce Malware and Scams TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits and 20 More Stories China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise FCC Bans New Foreign-Made Routers Over Supply Chain and Cyber Risk Concerns New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks ⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers and More Popular Resources SANS SEC401: Get Hands On Skills to Detect and Respond to Cyber Threats Detect AI-Driven Threats Faster With Full Network Visibility [Guide] Learn How to Govern AI Agents With Proven Market Guidance [Demo] Discover SaaS Risks and Monitor Every App in Your Environment