Guardsix Blog | Cybersecurity Research & Threat Intelligence

BYOVD: How Signed Drivers Become Kernel-Level Backdoors

Written by Akanksha Giri | Aug 19, 2026, 4:50:03 AM

Fast facts

  • 54 out of 90 EDR killers actively used in the wild are BYOVD-based, abusing 35 signed drivers that Windows trusts by default.
  • Bitdefender predicts BYOVD will reach a prevalence rate of 75% or more in ransomware attacks going forward.
  • Adversaries generate over 2,500 distinct variants of TrueSight.sys driver (version 2.0.2) , each with a completely unique hash and a valid certificate.
  • A single BYOVD tool called EDRKillShifter is now shared across eight different ransomware gangs simultaneously, including Qilin, Medusa, and Blacksuit. BYOVD has become a commodity, not a custom job.

 

EDR killers: how a signed driver became ransomware's favourite trick

A year ago, "EDR killer" was a phrase we mostly saw in incident-response retrospectives. It is now a standard component of a ransomware intrusion. ESET's March 2026 report traced almost 90 EDR killer tools in active use, and 54 of them lean on the same trick: Bring Your Own Vulnerable Driver (BYOVD), collectively abusing 35 distinct vulnerable drivers.

A BYOVD (Bring Your Own Vulnerable Driver) attack is a technique where an attacker with local administrator access loads a legitimate, digitally signed driver that contains known security flaws onto a target system. They then exploit those flaws to execute code at the kernel level (Ring 0), allowing them to disable endpoint detection and response (EDR) agents or antivirus software before deploying ransomware or other payloads.

Why attackers love using BYOVD?

  • Trust: BYOVD works because Windows trusts a valid signature more than it questions what the signed code actually does. An attacker does not need to develop a malicious driver from scratch or steal a certificate. Instead, they can abuse a legitimate, signed kernel driver that already exposes dangerous functionality.
  • Privilege: Once the driver is loaded, the attacker gets kernel-level access, which is the highest level of privilege on the system. From kernel mode, the attacker can unregister the security callbacks EDR relies on to monitor process creation, file system activity, and registry changes. They can terminate Protected Process Light (PPL) processes which are supposed to be untouchable even by administrators. They can patch system calls, unhook API monitoring, and basically rewrite the rules of the operating system in real-time.

Recent Campaign

 

The Gentlemen RaaS (Q1 2026)

Gentlemen, among the most active ransomware groups of Q1 2026, supplies affiliates with a centralised EDR-killing suite.

This group built an in-house framework called GentleKiller with eight variants, each impersonating a different legitimate security product and using a different vulnerable or malicious driver. One variant, G11, uses PoisonX—a driver that appears to have been signed by Microsoft itself. GentleKiller targets 400 EDR processes from 48 different vendors including Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto Networks, ESET, Bitdefender, Kaspersky and Trellix. The Gentlemen also operationalizes newly disclosed BYOVD proof-of-concepts within days of public release.

SilverFox (July 2026 )

Cato CTRL's July 2026 research shows Silver Fox (also tracked via its ValleyRAT/Winos 4.0 implant) moving beyond single-driver BYOVD into a reusable framework that can swap between three signed-but-vulnerable drivers: BootRepair.sys, EnPortv.sys (notably from EnCase forensic software, the same vendor lineage flagged separately by Huntress in February 2026), and wsftprm.sys (CVE-2023-52271) — so the operation survives if any single driver gets blocklisted.

Reynolds Ransomware (February 2026)

In February 2026, Reynolds ransomware emerged as a new ransomware family with a vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947) embedded directly inside the ransomware payload itself, not dropped as a separate tool. Upon execution, it dropped the driver as C:\ProgramData\402.sys, loaded it, and used it to terminate processes from CrowdStrike Falcon, Palo Alto Cortex XDR, Sophos, Symantec, and Avast before encryption began.

GodDamn Ransomware & PoisonX ( July 2026)

In mid-2026, Symantec's Threat Hunter Team spotted a new ransomware family called GodDamn (assessed to be a rebrand of Beast ransomware) deploying a driver called PoisonX (g11.sys). The attackers used it alongside a user-mode evasion tool disguised as a Symantec product to disable endpoint defenses. In one intrusion, they blinded defenses across at least ten hosts inside a single organization within two days, harvesting credentials with NirSoft tools, deploying AnyDesk for remote access, and clearing the way for encryption.

Qilin Ransomware (2025–2026)

Qilin deployed a multi-stage BYOVD chain via DLL side-loading. The chain loaded two vulnerable drivers: rwdrv.sys (a renamed ThrottleStop driver) and hlpdrv.sys to gain physical memory access, unregister EDR kernel callbacks, and terminate over 300 EDR drivers across virtually every major security vendor. The same driver combo was also observed in Akira and Makop intrusions.

DeadLock Ransomware (December 2025)

In December 2025, Cisco Talos documented a DeadLock ransomware campaign using a BYOVD loader against a vulnerable Baidu Antivirus driver to terminate EDR processes, disable Windows Defender entirely, stop services, and impair recovery mechanisms.

 

The Blocklist Problem

Microsoft's answer to BYOVD is the Vulnerable Driver Blocklist, they deny known-bad drivers by Authenticode hash, file name and version, and signer certificate. It's a genuinely useful control. It's also, on its own, not enough, and the last few years have shown ways attackers get past it.

CheckPoint found attackers created over 2,500 distinct variants of the TrueSight.sys (version 2.0.2) driver by tweaking just 8 bytes in the PE header. Each variant has a completely unique hash. Each one carries a still-valid Microsoft digital signature. And because the blocklist works largely on hashes and known signatures, every single one of those 2,500 variants sails right past it.

In February 2026, Huntress documented an intrusion where a EnPortv.sys driver loaded successfully despite its certificate being expired and explicitly revoked. This works because of a real gap in Driver Signature Enforcement: at load time, the kernel only checks that a signature is cryptographically valid and chains to a trusted root, in this case up through VeriSign's old Class 3 Code Signing CA to the Microsoft Code Verification Root that Windows still trusts for kernel-mode signing. In the case Huntress investigated, the driver's certificate was issued in December 2006 and expired in January 2010, well before it was later revoked, but the driver carried a trusted timestamp from before that expiry, so Windows treats the signature as valid indefinitely. Because the certificate predates a July 2015 cutoff, it also qualifies for a legacy exception that still lets older, cross-signed drivers load for backward compatibility.