The financially motivated Scattered Spider group has been spotted attempting to distribute outdated Intel Ethernet diagnostic drivers in BYOVD (Bring Your Own Vulnerable Driver) attacks to bypass EDR (Endpoint Detection and Response) solutions.
The BYOVD method allows attackers to elevate privileges in Windows by exploiting vulnerable drivers in kernel mode. Since drivers have direct access to the OS kernel, compromising them allows code to be executed with the highest privileges.
According to CrowdStrike, attackers attempted to exploit the CVE-2015-2291 vulnerability in the Intel Ethernet driver. It allows arbitrary code to be executed in kernel mode using specially crafted calls. Although the problem was fixed back in 2015, hackers can deliberately install older versions of the driver on infected devices and use them for attacks.
Scattered Spider uses a compact 64-bit kernel driver with 35 functions. Windows does not block it because it is signed with valid certificates stolen from organizations such as NVIDIA and Global Software LLC. Using the driver, hackers disable security solutions (SentinelOne, Cortex XDR from Palo Alto Networks, and Microsoft Defender for Endpoint), hide their activity, and weaken the security capabilities of their victims’ networks.
After the malicious routines are implemented, the security drivers continue to appear active, but in fact they no longer protect the system. According to CrowdStrike, although Scattered Spider attacks target a limited number of companies, no one can ignore the BYOVD threat. The same tactic has already been used by well-known groups, including BlackByte and North Korea’s Lazarus.
In 2021, Microsoft attempted to address the issue by creating a driver blocklist. However, by default, Windows did not block vulnerable drivers unless it was Windows 11 2022 Update and newer versions. As ArsTechnica wrote, until recently, the list was only updated with major OS releases, leaving many devices vulnerable. Microsoft later released patches that fixed this process and established regular updates to the block list.
To protect against BYOVD attacks, Microsoft recommends that users enable the driver block list through Memory Integrity or Windows Defender Application Control (WDAC) features. However, enabling Memory Integrity may be difficult on systems with outdated drivers.