ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kern...
sc.exe create ACPIx86.sys binPath=C:\windows\temp\ACPIx86.sys type=kernel && sc.exe start ACPIx86.syssc.exe create ACPIx86.sys binPath=C:\windows\temp\ACPIx86.sys type=kernel && sc.exe start ACPIx86.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068