Hackers Exploit SonicWall SSLVPN Credentials to Deploy EDR Killer and Bypass Security

Threat actors are exploiting compromised SonicWall SSLVPN credentials to infiltrate networks and deploy an "EDR killer" that can disable endpoint security solutions.

In February 2026, an analysis by Huntress revealed that attackers used valid VPN accounts to initially access systems and execute a Bring Your Own Vulnerable Driver (BYOVD) attack using a revoked Guidance Software (EnCase) forensic driver.

This method allows the attackers to terminate critical security processes at the kernel level, bypassing standard protections.

The breach began when the threat actor authenticated to a SonicWall SSLVPN using compromised credentials, avoiding brute-force attacks.

Huntress identified a successful login from the malicious IP address 69.10.60[.]250 . Prior to this, logs recorded a failed login attempt from IP 193.160.216[.]221 due to insufficient privileges.

Following the breach, the attacker commenced aggressive reconnaissance, with SonicWall IPS alerts noting high-volume activity including ICMP ping sweeps and NetBIOS probes.

The attacker also initiated SYN flood behavior, generating traffic of over 370 SYNs/second to map the internal environment.

The attack involved a 64-bit Windows executable designed to deploy a malicious kernel driver. To avoid static analysis, the malware authors used a custom encoding scheme, hiding the driver payload with a wordlist substitution cipher.

Instead of standard encryption, a 256-word dictionary was used where specific byte values were represented by English words, such as "about" decoding to 0x00 and "block" to 0x4D .

Upon execution, the malware decodes this "text" into a valid Windows PE file, placing it at C:\ProgramData\OEM\Firmware\OemHwUpd.sys .

Anti-forensic techniques like "timestomping" were employed by copying timestamps from the legitimate ntdll.dll to the malicious driver. The payload registers as a kernel service named "OEM Hardware HAL Service" to maintain persistence across reboots.

The attack leverages a gap in Windows Driver Signature Enforcement (DSE). The deployed driver is a legitimate component of Guidance Software's EnCase forensic suite ( EnPortv.sys ), signed with an expired and revoked certificate.

Despite the revocation, Windows loads the driver because the kernel primarily checks the cryptographic integrity of the signature rather than the Certificate Revocation List (CRL) during boot.

Since the driver was timestamped by a trusted authority before the certificate expired, it meets Microsoft's legacy exception for drivers signed before July 29, 2015. This allows the attacker to load the driver and expose an IOCTL interface ( 0x223078 ) to user-mode processes.

Once loaded, the driver enables the attacker to terminate processes protected by mechanisms like Protected Process Light (PPL). The malware targets a list of 59 processes associated with major security vendors, including Microsoft Defender, CrowdStrike, SentinelOne, and Carbon Black.

The kill loop runs continuously with a one-second sleep interval to ensure immediate termination of any restarting security services.

Type Value Description

File Path C:\ProgramData\OEM\Firmware\OemHwUpd.sys Location where the malicious driver is dropped

Service Name OemHwUpd Kernel service created for persistence

Service Display Name OEM Hardware HAL Service Disguised service name to blend with legitimate tools

IPv4 Address 69.10.60[.]250 Source IP for successful VPN authentication

IPv4 Address 193.160.216[.]221 Source IP for failed portal login attempt

SHA-256 3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee0 Vulnerable EnCase forensic driver ( OemHwUpd.sys )

SHA-256 6a6aaeed4a6bbe82a08d197f5d40c2592a461175f181e0440e0ff45d5fb60939 EDR killer binary masquerading as svchost.exe

Based on reporting by Cyber Security News.