Hackers Weaponize 2,500+ Security Tools to Disable Endpoint Defenses Before Ransomware Attacks
A recent campaign has exploited over 2,500 variants of a legitimate security driver to disable endpoint protection, subsequently deploying ransomware and remote access trojans. This operation involves the misuse of truesight.sys , a kernel-mode driver…
A recent campaign has exploited over 2,500 variants of a legitimate security driver to disable endpoint protection, subsequently deploying ransomware and remote access trojans. This operation involves the misuse of truesight.sys , a kernel-mode driver from Adlice Software's RogueKiller antivirus suite. The legacy version 2.0.2 of this driver contains a critical vulnerability that allows arbitrary process termination via IOCTL command 0x22E044, enabling attackers to terminate any process, including protected security software.
Check Point Research identified this operation in January 2025, revealing how attackers exploit a Windows driver signing policy loophole to bypass modern defenses. They modify the driver's PE structure while preserving its valid digital signature, creating thousands of unique variants that evade hash-based detection.
The attack begins with phishing emails, fake software websites, compromised Telegram channels, or watering hole attacks and proceeds through three stages:
Stage 1: A downloader masquerading as a legitimate installer establishes initial access. Stage 2: Persistence via scheduled tasks and DLL side-loading. Stage 3: Deployment of an EDR killer module combined with the final payload.
This operation involves the misuse of truesight.sys , a kernel-mode driver from Adlice Software's RogueKiller antivirus suite.
The EDR killer module targets 192 security products, including CrowdStrike Falcon, SentinelOne, Sophos, Trend Micro, Kaspersky, and ESET. It downloads the TrueSight driver if absent, installs it as "TCLService," sends termination commands to all targeted processes, deletes security software from disk, and deploys the final payload with zero defensive visibility. The entire process can be completed in 30 minutes.
Check Point attributes the primary campaign to Silver Fox, a financially motivated Chinese threat actor active since June 2024. The technique has spread to ransomware groups such as RansomHub, Qilin, INC, BlackCat, and other APT groups. Approximately 75% of victims are in mainland China, with 15% in Singapore, Taiwan, and Hong Kong, and 10% elsewhere in the Asia-Pacific region.
The final payload is HiddenGh0st, a Gh0st RAT variant providing remote control, keylogging, screen capture, data exfiltration, and surveillance capabilities. Organizations are advised to update Microsoft's Vulnerable Driver Blocklist, enable HVCI (Hypervisor-Protected Code Integrity), implement application control policies, and monitor for suspicious driver installations. This campaign highlights the limitations of reactive hash-based detection against polymorphic threats, emphasizing the importance of proactive driver abuse monitoring.
Based on reporting by GBHackers.