{"id":45158,"date":"2026-04-07T02:43:58","date_gmt":"2026-04-06T18:43:58","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/qilin-and-warlock-ransomware-use-vulnerable-drivers-to-disable-300-edr-tools\/"},"modified":"2026-04-07T02:43:58","modified_gmt":"2026-04-06T18:43:58","slug":"qilin-and-warlock-ransomware-use-vulnerable-drivers-to-disable-300-edr-tools","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/qilin-and-warlock-ransomware-use-vulnerable-drivers-to-disable-300-edr-tools\/","title":{"rendered":"Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools"},"content":{"rendered":"
\"Qilin<\/a><\/div>\n

Threat actors associated with Qilin<\/a> and Warlock<\/a> ransomware operations have been observed using the bring your own vulnerable driver (BYOVD<\/a>) technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro.<\/p>\n

Qilin attacks analyzed by Talos have been found to deploy a malicious DLL named “msimg32.dll,” which initiates a multi-stage infection chain to disable endpoint detection and response (EDR) solutions. The DLL, launched via DLL side-loading, is capable of terminating more than 300 EDR drivers from almost every security vendor in the market.<\/p>\n

“The first stage consists of a PE loader responsible for preparing the execution environment for the EDR killer component,” Talos researchers Takahiro Takeda and Holger Unterbrink said<\/a>. “This secondary payload is embedded within the loader in an encrypted form.”<\/p>\n

The DLL loader implements an array of techniques to evade detection. It neutralizes user-mode hooks, suppresses Event Tracing for Windows (ETW) event logs, and takes steps to conceal control flow and API invocation patterns. As a result, it allows the main EDR killer payload to be decrypted, loaded, and executed entirely in memory while entirely flying under the radar.<\/p>\n

Once launched, the malware makes use of two drivers –<\/p>\n