Interlock Ransomware Exploits Zero-Day in Gaming Anti-Cheat Driver to Disable EDR, AV
Recent analysis has identified the Interlock ransomware operators utilizing a new process-killing tool that exploits a zero-day vulnerability found in a gaming anti-cheat kernel driver. This tool aims to disable endpoint defense mechanisms (EDR/AV).
Recent analysis has identified the Interlock ransomware operators utilizing a new process-killing tool that exploits a zero-day vulnerability found in a gaming anti-cheat kernel driver. This tool aims to disable endpoint defense mechanisms (EDR/AV).
This activity was observed during an intrusion at a North America-based educational institution, indicating that Interlock is developing proprietary tools instead of relying on the Ransomware-as-a-Service (RaaS) ecosystem.
In this incident, initial access was linked to MintLoader activity on an end-user system, followed by the deployment of a legitimate Node.js runtime used to execute malicious JavaScript implants.
The JavaScript stages align with known reporting on "NodeSnakeRAT" and "Interlock RAT," which the operators employed for persistence, discovery, and remote control, including SOCKS5 proxy and command execution.
As the intrusion advanced, the operators also utilized ScreenConnect for GUI-based access and employed common administrative techniques (RDP, firewall rule adjustments) to navigate through the network environment.
A significant development is the emergence of a new bring-your-own-vulnerable-driver (BYOVD) tool, identified as a DLL (polers.dll) and referred to by FortiGuard IR as "Hotta Killer."
Upon execution, the payload collects system information from the victim's device by executing the 'systeminfo' command through PowerShell.
The tool installs a signed x64 kernel driver named UpdateCheckerX64.sys, which is a renamed anti-cheat driver (originally GameDriverx64.sys) vulnerable to CVE-2025-61155.
Upon execution, the payload collects system information from the victim's device by executing the 'systeminfo' command through PowerShell.
It creates a demand-start kernel driver service using standard Windows APIs (OpenSCManagerW, CreateServiceW, StartServiceW), registering the driver as a kernel service.
Once loaded, the tool parses a command-line keyword, converts it to a target pattern, enumerates running processes, and extracts the PID of a match. It then passes that PID to the driver using a device interface and calls DeviceIoControl, where the driver validates an IOCTL (0x222040) and a magic flag (0xFA123456) before executing ZwTerminateProcess to kill the selected process.
Operators attempted to maintain the tool's operation using looped execution, aiming to suppress security tools during later ransomware stages.
Defensive strategies include monitoring for unexpected kernel driver installations, suspicious service creation linked to new .sys files, and BYOVD telemetry that indicates defense-evasion efforts during ransomware preparation.
FortiGuard describes the tool as an elevated process killer and notes that it did not completely disrupt the targeted Fortinet software's operation. However, the technique remains significant because anti-cheat drivers have historically been repurposed by ransomware actors to gain kernel-level control over defensive processes.
Based on reporting by GBHackers.