Full Report
Huntress uncovers a tax-themed malvertising campaign using Google Ads, dual cloaking, rogue ScreenConnect, and an undocumented Huawei driver to kill AV/EDR.
Analysis Summary
# Tool/Technique: Tax-Themed Malvertising & BYOVD EDR Killer
## Overview
This campaign is a sophisticated malvertising operation targeting U.S. users searching for tax documents (W-2, W-9). It utilizes a layered attack chain involving commercial cloaking, rogue ScreenConnect instances for initial access, and a Bring Your Own Vulnerable Driver (BYOVD) technique to terminate security software from kernel mode. The campaign is likely the work of a Russian-speaking initial access broker (IAB) preparing environments for ransomware.
## Technical Details
- **Type:** Malvertising Campaign / BYOVD Malware
- **Platform:** Windows (x64)
- **Capabilities:** Anti-analysis (cloaking), Remote Monitoring and Management (RMM) persistence, EDR/AV termination, Credential Harvesting.
- **First Seen:** January 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1589.002 - Gather Victim Identity Information: Digital Certificates]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1064 - Scripting]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1027.001 - Obfuscation: Binary Padding] (2GB memory allocation)
- [T1068 - Exploitation for Privilege Escalation] (BYOVD)
- **[TA0009 - Collection]**
- [T1003.001 - OS Credential Dumping: LSASS Memory]
## Functionality
### Core Capabilities
- **Malvertising & Cloaking:** Uses Google Ads to lure victims to landing pages. Employs "JustCloakIt" (server-side) and "Adspect" (client-side) to serve benign content to scanners/researchers while delivering the payload to genuine targets.
- **Rogue RMM Persistence:** Installs trial versions of ScreenConnect (ConnectWise Control) and FleetDeck to establish hands-on-keyboard access.
- **Multi-Stage Crypter:** Uses a 2GB memory allocation trick to crash automated sandboxes and EDR emulators that cannot handle large memory overheads.
### Advanced Features
- **BYOVD EDR Killer:** Leverages a previously undocumented, legitimate signed Huawei audio driver. By exploiting a vulnerable IOCTL handler in the driver, the malware gains kernel-mode privileges to forcibly terminate protected security processes including Windows Defender, Kaspersky, and SentinelOne.
- **Lateral Movement:** Once security tools are blinded, the attackers deploy NetExec for mass credential harvesting across the local network.
## Indicators of Compromise
*Note: Some specific hashes were truncated in the source text; placeholders are used where data was implied.*
- **File Names:** `W2_Form_2026.exe`, `ScreenConnect.Client.exe`, `HuaweiAudioControl.sys` (or similar driver name).
- **Network Indicators (Defanged):**
- `justcloakit[.]com` (Cloaking service)
- `adspect[.]ai` (Cloaking service)
- `connectwise[.]com` (Abused for trial instances)
- `45.15.156[.]x` (Payload delivery/C2)
- **Behavioral Indicators:**
- Deployment of multiple different RMM tools on a single endpoint within a short window.
- Unexpected loading of signed drivers (BYOVD) not associated with the system's hardware.
- Termination of `MsMpEng.exe` or other EDR service processes originating from a kernel-level call.
## Associated Threat Actors
- **Unidentified Russian-speaking IAB:** Inferred from Russian-language JavaScript comments in a fake Chrome update lure found on the same infrastructure. Tactics align with pre-ransomware staging.
## Detection Methods
- **Signature-based detection:** Monitor for the specific undocumented Huawei driver hash (if available) and rogue ScreenConnect installers using generic trial licenses.
- **Behavioral detection:**
- Alert on processes allocating >1GB of memory immediately upon execution (anti-sandbox trick).
- Monitor for `DeviceIoControl` calls to unusual or non-standard drivers.
- Detect the sudden cessation of EDR heartbeats/telemetry from an active host.
- **YARA rules:** Target the specific multi-stage crypter patterns and the IOCTL interaction code used to trigger the EDR kill.
## Mitigation Strategies
- **Prevention measures:** Implement strict ad-blocking at the organizational level to mitigate malvertising.
- **Hardening recommendations:**
- Enable **Microsoft Vulnerable Driver Blocklist**.
- Restrict the installation of RMM tools to a pre-approved "allow-list."
- Implement Credential Guard to protect LSASS from dumping.
- **Policy:** Educate users to download tax forms only from official `.gov` or verified corporate portals, avoiding "Sponsored" search results.
## Related Tools/Techniques
- **EDRSilencer:** Similar intent of blinding EDR, though EDRSilencer typically uses WFP filters rather than BYOVD.
- **BlackByte / AuKill:** Other known malware families that pioneered the BYOVD technique for EDR termination.