Attackers are increasingly targeting Windows by exploiting vulnerable drivers and, in the second quarter of 2024, the number of systems attacked using this technique increased by nearly 23% compared to the first quarter, says Kaspersky.
Vulnerable drivers may be exploited for a wide range of attacks including ransomware and Advanced Persistent Threats (APTs).
Cyberattacks that utilise vulnerable drivers are known as BYOVD (Bring Your Own Vulnerable Driver). They allow threat actors to attempt to disable security solutions on a system and escalate privileges enabling them to carry out various malicious activities such as installing ransomware or establishing persistence for espionage or sabotage – particularly if an Advanced Persistent Threat (APT) group is behind the attack.
Kaspersky reports that this attack technique accelerated in 2023 and is currently gaining momentum with a potential impact on both individuals and organisations. In Q2 2024, the number of systems attacked with the BYOVD technique increased by almost 23% compared to the previous quarter.
“While the drivers themselves are legitimate they may contain vulnerabilities,” explains Vladimir Kuskov, head of Anti-Malware Research at Kaspersky. “These vulnerabilities can then be exploited for malicious purposes. Perpetrators use various tools and methods to install a vulnerable driver on the system. Once the operating system loads this driver the attacker can exploit it to circumvent OS kernel security boundaries for their own goals.”
One concerning aspect of this trend is the proliferation of tools that exploit vulnerable drivers – they can be found online. While relatively few of these tools exist in 2024 – only 24 projects have been published since 2021- Kaspersky experts observed an increase in the number of these tools being published online last year.
“Although nothing really stops threat actors from developing their own private tools, the publicly available ones eliminate the need for the specific skills required to research and exploit vulnerable drivers,” says Kuskov. “In 2023 alone, we identified approximately 16 new tools of this nature marking a substantial increase from the mere one or two we observed in previous years. Given this rise, it is highly advisable to implement robust protective measures for any system.”