Per Sophos X-Ops research (Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious kernel driver (often with a random five-letter name) signed with compromised or revoked code-signing certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The tool targets many security products by killing their services and processes and is frequently distributed packed with HeartCrypt by ransomware groups (e.g., RansomHub, INC). Driver names are hard-coded per ...
sc.exe create cyvrlpc.sys binPath=C:\windows\temp\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.syssc.exe create cyvrlpc.sys binPath=C:\windows\temp\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
Per Sophos X-Ops research (Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious kernel driver (often with a random five-letter name) signed with compromised or revoked code-signing certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The tool targets many security products by killing their services and processes and is frequently distributed packed with HeartCrypt by ransomware groups (e.g., RansomHub, INC). Driver names are hard-coded per sample (e.g., mraml.sys, noedt.sys).
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068