Full Report
Huntress responded to a 2026 intrusion using compromised SonicWall VPN credentials and a revoked EnCase forensic driver to terminate EDR processes via BYOVD.
Analysis Summary
# Incident Report: SonicWall Compromise and EnCase BYOVD EDR Killer
## Executive Summary
In February 2026, a threat actor gained initial access to a victim network using compromised SonicWall SSLVPN credentials. Once inside, the attacker attempted to blind security defenses by deploying a custom "EDR killer" tool that leveraged a revoked Guidance Software (EnCase) forensic driver via a Bring Your Own Vulnerable Driver (BYOVD) technique. The attack was successfully disrupted by Huntress managed services before the final objective—likely ransomware deployment—could be achieved.
## Incident Details
- **Discovery Date:** February 2026
- **Incident Date:** February 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** International (based on attacker IP telemetry)
## Timeline of Events
### Initial Access
- **Date/Time:** Early February 2026
- **Vector:** Compromised SSLVPN Credentials
- **Details:** The threat actor first attempted a portal login from `193.160.216[.]221`, which was denied due to lack of privileges. One minute later, they successfully authenticated via the VPN client using a different IP address: `69.10.60[.]250`.
### Lateral Movement
- **Details:** Following authentication, the attacker conducted aggressive internal reconnaissance, including ICMP ping sweeps and NetBIOS name request probes. SMB-targeted activity was observed with SYN flood behavior exceeding 370 SYNs per second as the attacker sought targets for lateral movement.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported. The primary impact was the attempted termination of security software processes across the environment to facilitate follow-on manual actions.
### Detection & Response
- **Detection:** Huntress Managed SIEM ingested SonicWall telemetry, alerting on the suspicious VPN login patterns and subsequent aggressive scanning.
- **Response:** Huntress EDR identified the deployment of the malicious binary; affected systems were quarantined and the intrusion was neutralized before ransomware could be deployed.
## Attack Methodology
- **Initial Access:** Valid Accounts (SSLVPN Credentials).
- **Persistence:** Not specified in the brief, but likely intended via VPN access.
- **Privilege Escalation:** Exploitation of kernel-level access via vulnerable driver.
- **Defense Evasion:** Bring Your Own Vulnerable Driver (BYOVD); the attacker used an EDR killer that loaded a signed but revoked Guidance Software (EnCase) driver to terminate security agents from kernel mode.
- **Credential Access:** Likely obtained via prior credential stuffing or phishing (external to the incident timeline).
- **Discovery:** ICMP ping sweeps, NetBIOS name probes, and SMB SYN flooding.
- **Lateral Movement:** Targeted SMB activity.
- **Impact:** Impair Defenses (Disabling EDR/AV).
## Impact Assessment
- **Financial:** Minimal (due to successful disruption).
- **Data Breach:** None reported.
- **Operational:** Temporary disruption due to system quarantine and remediation.
- **Reputational:** Low; the attack was intercepted.
## Indicators of Compromise
- **Network Indicators:**
- `193.160.216[.]221` (Attacker Portal Login Attempt)
- `69.10.60[.]250` (Attacker VPN Authentication)
- **File Indicators:**
- EDR Killer Binary (64-bit Windows executable masquerading as a firmware update)
- EnCase Forensic Driver (Decoded from wordlist-based substitution cipher)
- **Behavioral Indicators:**
- High-frequency SMB SYN flooding (>370 SYNs/sec)
- Unauthorized loading of `EDR-Killer` kernel drivers
## Response Actions
- **Containment:** Isolated infected endpoints via EDR quarantine.
- **Eradication:** Terminated malicious processes and deleted the EDR killer binaries and associated drivers.
- **Recovery:** Client notified to reset all VPN credentials and implement MFA.
## Lessons Learned
- **Driver Signature Enforcement Gap:** Attackers continue to exploit the fact that Windows may still load drivers with revoked or expired certificates (BYOVD).
- **SIEM Criticality:** VPN telemetry was essential for identifying the switch from a failed portal login to a successful client login, which provided the first indicator of compromise.
- **Obfuscation Trends:** Attackers are using creative encoding (like the English wordlist cipher) to bypass static file analysis.
## Recommendations
1. **Enforce MFA:** Ensure Multi-Factor Authentication is strictly enforced for all VPN and portal access points.
2. **Implement Driver Blocklists:** Use Microsoft’s recommended driver blocklist or tools like WDAC (Windows Defender Application Control) to prevent the loading of known vulnerable/revoked drivers.
3. **Restrict VPN Access:** Limit VPN access to known geographical regions or specific IP allow-lists where feasible.
4. **Monitor for BYOVD:** Configure EDR to alert on the loading of drivers not commonly found in the environment, especially those associated with forensic or utility tools.