Connect with us

Hi, what are you looking for?



Microsoft Revokes Many Signed Drivers Used by Chinese Cybercriminals

Microsoft has revoked signed drivers used for post-exploitation activity, in many cases by Chinese cybercriminals.

After being notified by several security firms, Microsoft has revoked many signed drivers that had been leveraged by threat actors, in many cases by Chinese cybercriminals. 

Signed drivers can be highly useful to threat actors, allowing them to gain complete control of an already-compromised system. These drivers can be used to manipulate system processes, evade endpoint security products, and maintain persistence on a system.

Cybersecurity firms often come across campaigns abusing signed drivers. In December 2022, for instance, Microsoft took action after SentinelOne, Mandiant and Sophos warned it that cybercriminals had been using signed malicious drivers to kill processes associated with security products. 

Microsoft published an advisory at the time to inform users that drivers certified by its Windows Hardware Developer Program (WHDP) were being used by hackers with elevated privileges in post-exploitation activity. The company said activity was limited to the abuse of some developer program accounts and noted that its systems had not been compromised. 

On Tuesday, the tech giant released a very similar advisory, this time crediting Sophos, Cisco and Trend Micro for informing it about the abuse of signed drivers.

“First reported by Sophos, and later Trend Micro and Cisco, Microsoft has investigated and confirmed a list of third-party WHCP-certified drivers used in cyber threat campaigns. Because of the drivers’ intent and functionality, Microsoft has added them to the Windows Driver.STL revocation list,” Microsoft said in an accompanying support document

Sophos, Cisco and Trend Micro each published a blog post describing their findings on Tuesday.

Advertisement. Scroll to continue reading.

Sophos identified 133 malicious drivers, including 100 signed with a Microsoft WHCP certificate. Many of the non-WHCP signed drivers were issued to Chinese companies. 

Some of the drivers were used to kill endpoint security products, while others acted as rootkits, quietly running in the background. The rootkits included known families such as FU, Fivesys, FK_undead or Netfilter. Some of them allow attackers to bypass security features, such as the Windows User Account Controls (UAC) feature, on the compromised system. 

Cisco’s blog post describes some of the open source tools abused by threat actors to change the signing date of kernel mode drivers, allowing them to load malicious drivers signed with expired certificates. The attackers are “taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015.”

One of the malicious drivers analyzed by Cisco, named RedDriver, has been used by Chinese cybercriminals to intercept the browser traffic of Chinese users. 

Trend Micro has detailed a campaign involving a new signed rootkit believed to have been used by the threat actor that’s also behind the Fivesys rootkit. 

“This malicious actor originates from China and their main victims are the gaming sector in China. Their malware seems to have passed through the Windows Hardware Quality Labs (WHQL) process for getting a valid signature,” the company said.  

Related: Cybercrime Group Exploiting Old Windows Driver Vulnerability to Bypass Security Products

Related: Ransomware Operator Abuses Anti-Cheat Driver to Disable Antiviruses

Related: Iranian Hackers Using New Windows Kernel Driver in Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...