Cisco Talos and Trend Micro have found that threat actors using Qilin and Warlock ransomware are employing the bring your own vulnerable driver (BYOVD) method to shut down security programs on compromised systems.

Talos’ research into Qilin attacks has revealed the deployment of a harmful DLL file, “msimg32.dll,” which sets off a multi-step process to deactivate endpoint detection and response (EDR) systems. This DLL, launched through DLL side-loading, can terminate over 300 EDR drivers from nearly every security vendor.

“The initial phase involves a PE loader that prepares the environment for the EDR killer,” Talos researchers Takahiro Takeda and Holger Unterbrink stated. “The encrypted secondary payload is embedded within the loader.”

The DLL loader uses multiple techniques to avoid being detected. It disables user-mode hooks, stops Event Tracing for Windows (ETW) logs, and hides control flow and API usage. This allows the main EDR killer payload to be decrypted, loaded, and run completely in memory without being noticed.

Once running, the malware uses two drivers:

• rwdrv.sys, a renamed version of “ThrottleStop.sys,” grants access to the system’s physical memory and acts as a kernel-mode hardware access layer.
• hlpdrv.sys terminates processes linked to more than 300 different EDR drivers from various security vendors.

Notably, both drivers have been used in BYOVD attacks alongside Akira and Makop ransomware intrusions.

“Before loading the second driver, the EDR killer removes monitoring callbacks set up by the EDR, ensuring process termination proceeds without issues,” Talos explained. “This shows the advanced methods the malware uses to bypass or completely disable modern EDR features on compromised systems.”

CYFIRMA and Cynet report that Qilin has become the most active ransomware group recently, claiming hundreds of victims. The group was linked to 22 of 134 ransomware incidents reported in Japan in 2025, or 16.4% of all attacks.

“Qilin primarily uses stolen credentials for initial access,” Talos noted. “After successfully infiltrating a target, they focus on post-compromise activities, methodically expanding control and maximizing impact.”

The cybersecurity vendor also pointed out that ransomware execution typically occurs about six days after the first intrusion, emphasizing the need for organizations to quickly detect malicious activity and prevent ransomware deployment.

This news arrives while the Warlock (aka Water Manaul) ransomware group continues to exploit unpatched Microsoft SharePoint servers, updating its tools for better persistence, lateral movement, and defense evasion. This includes using TightVNC for persistent control and a legitimate but vulnerable NSec driver (“NSecKrnl.sys”) in a BYOVD attack to terminate security products at the kernel level, replacing the “googleApiUtil64.sys” driver from previous campaigns.

Tools observed during the Warlock attack in January 2026 included:

• PsExec, for moving laterally.
• RDP Patcher, to allow multiple RDP sessions.
• Velociraptor, for command and control (C2).
• Visual Studio Code and Cloudflare Tunnel, for tunneling C2 communications.
• Yuze, for intranet penetration and creating a reverse proxy connection to the attacker’s C2 server over HTTP (port 80), HTTPS (port 443), and DNS (port 53).
• Rclone, for data theft.

To defend against BYOVD threats, it’s recommended to only allow signed drivers from trusted publishers, monitor driver installation, and keep security software updated, especially those with drivers that could be exploited.

“Warlock’s use of vulnerable drivers to disable security requires a multi-layered defense focused on kernel integrity,” Trend Micro stated. “Therefore, organizations need to go beyond basic endpoint protection and enforce strict driver governance and real-time monitoring of kernel activities.”