Skip to main content

Hackers have found a way to hack you that you’d never expect

A security flaw has allowed a ransomware gang to effectively prevent antivirus programs from running properly on a system.

As reported by Bleeping Computer, the BlackByte ransomware group is utilizing a newly discovered method related to the RTCore64.sys driver to circumvent more than 1,000 legitimate drivers.

A depiction of a hacker breaking into a system via the use of code.
Getty Images

Security programs that rely on such drivers are therefore unable to detect a breach, with the technique itself being labeled as “Bring Your Own Driver” by researchers.

Once the drivers have been turned off by the hackers, they can operate under the radar due to the lack of multiple endpoint detection and response (EDR). The vulnerable drivers are able to pass an inspection via a valid certificate, and they also feature high privileges on the PC itself.

Researchers from cybersecurity company Sophos detail how the MSI graphics driver that is targeted by the ransomware gang offers I/O control codes that can be accessed through user-mode processes. However, this element breaches Microsoft’s security guidelines on kernel memory access.

Due to the exploit, threat actors can freely read, write, or execute code within a system’s kernel memory.

BlackByte is naturally keen to avoid being detected so as to not have its hacks analyzed by researchers, Sophos stated — the company pointed toward attackers looking for any debuggers running on the system and then quitting.

Furthermore, the group’s malware scans the system for any potential hooking DLLs connected to Avast, Sandboxie, Windows DbgHelp Library, and Comodo Internet Security. Should any be found by the search, BlackByte disables its ability to function.

Because of the sophisticated nature of the technique used by the threat actors, Sophos warned that they will continue to exploit legitimate drivers in order to bypass security products. Previously, the “Bring Your Own Driver” method was seen being used by the North Korean hacking group Lazarus, which involved a Dell hardware driver.

Bleeping Computer highlights how system administrators can protect their PCs by putting the MSI driver (RTCore64.sys) that is being targeted into an active blocklist.

BlackByte’s ransomware efforts first came to light in 2021, with the FBI stressing that the hacking group was behind certain cyberattacks on the government.

Editors' Recommendations

Zak Islam
Computing Writer
Zak Islam was a freelance writer at Digital Trends covering the latest news in the technology world, particularly the…
Hackers are using a devious new trick to infect your devices
A person using a laptop with a set of code seen on the display.

Hackers have long used lookalike domain names to trick people into visiting malicious websites, but now the threat posed by this tactic could be about to ramp up significantly. That’s because two new domain name extensions have been approved which could lead to an epidemic of phishing attempts.

The two new top-level domains (TLDs) that are causing such consternation are the .zip and .mov extensions. They’ve just been introduced by Google alongside the .dad, .esq, .prof, .phd, .nexus, .foo names.

Read more
Microsoft just gave you a new way to stay safe from viruses
A dark mystery hand typing on a laptop computer at night.

Microsoft has just taken a vital step towards better protecting your devices from malware, and it’s one that could stop viruses dead in their tracks. Interestingly, though, the Redmond giant seems to have made no mention of the change, despite its significance.

The new policy might sound minor on the surface: Microsoft’s SharePoint cloud storage service can apparently now scan files that are encrypted or password-protected. Previously, this wasn’t thought to be possible.

Read more
No, 1Password wasn’t hacked – here’s what really happened
A person using the 1Password password manager on a laptop while sat on a couch.

Password managers have been struggling with security breaches in recent months, with LastPass suffering a particularly bad hack as a notable example. So when 1Password users got an alert last week saying their Secret Keys and passwords had been changed without their knowledge, they were understandably panicked. Luckily, all was not what it seemed.

That’s because AgileBits, the company behind 1Password, has just explained exactly what went wrong during that event. And while it wasn’t as bad as everyone first thought, it still doesn’t paint AgileBits in a particularly good light.

Read more