Full Report
Huntress responded to a 2026 intrusion using compromised SonicWall VPN credentials and a revoked EnCase forensic driver to terminate EDR processes via BYOVD.
Analysis Summary
# Incident Report: BYOVD EDR Killer via SonicWall Compromise
## Executive Summary
In February 2026, threat actors gained initial access to a victim's network by leveraging compromised SonicWall SSLVPN credentials. Once inside, the attackers deployed a custom "EDR Killer" tool that utilized a Bring Your Own Vulnerable Driver (BYOVD) technique, specifically abusing a revoked Guidance Software (EnCase) forensic driver to terminate security processes from kernel mode. The incident was detected and disrupted by Huntress via SIEM and EDR correlation before the attackers could deploy ransomware.
## Incident Details
- **Discovery Date:** Early February 2026
- **Incident Date:** February 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** February 2026
- **Vector:** Compromised SSLVPN Credentials
- **Details:** The attacker first attempted a portal login (denied) from `193.160.216[.]221`. One minute later, they successfully authenticated via the SonicWall VPN client using a different IP: `69.10.60[.]250`.
### Lateral Movement
- **Details:** Following authentication, the attacker conducted aggressive reconnaissance including ICMP ping sweeps, NetBIOS name requests, and SMB-targeted SYN flooding (exceeding 370 SYNs/second) to identify targets for lateral movement.
### Data Exfiltration/Impact
- **Details:** The attack was disrupted during the defense evasion phase. No data exfiltration was reported, but the attacker successfully deployed an EDR-killing binary intended to blind security monitoring.
### Detection & Response
- **Detection:** Huntress Managed SIEM flagged the suspicious SonicWall authentication logs and correlated them with endpoint activity.
- **Response Actions:** Huntress isolated/quarantined affected systems and provided remediation steps, preventing the final stage of the attack (ransomware).
## Attack Methodology
- **Initial Access:** Compromised SonicWall SSLVPN credentials.
- **Persistence:** Not explicitly detailed, but involved maintaining VPN access.
- **Privilege Escalation:** Likely achieved to deploy a kernel-mode driver.
- **Defense Evasion:** Bring Your Own Vulnerable Driver (BYOVD). The attacker used a 64-bit executable masquerading as a firmware update that deployed a revoked EnCase driver. The driver was hidden within the binary using a "wordlist-based substitution cipher" to evade static analysis.
- **Credential Access:** Credential stuffing or previously compromised SSLVPN credentials.
- **Discovery:** ICMP sweeps, NetBIOS probing, and SMB SYN floods.
- **Impact:** Attempted termination of EDR/AV processes to facilitate ransomware deployment.
## Impact Assessment
- **Financial:** Minimal (Preventative intervention successful).
- **Data Breach:** None reported.
- **Operational:** Temporary disruption due to system isolation and scanning.
- **Reputational:** Minimal; incident was contained internally.
## Indicators of Compromise
- **Network Indicators:**
- `193.160.216[.]221` (Failed portal login)
- `69.10.60[.]250` (Successful VPN access)
- **File Indicators:**
- Embedded EnCase Driver (Guidance Software - revoked certificate).
- EDR Killer Binary (characterized by a 256-word dictionary for byte substitution).
- **Behavioral Indicators:**
- High-frequency SYN flooding (>370 SYNs/sec).
- Unauthorized loading of kernel drivers with revoked/expired certificates.
## Response Actions
- **Containment:** Quarantine of infected endpoints via EDR.
- **Eradication:** Removal of the malicious "firmware update" binary and the associated EnCase kernel driver.
- **Recovery:** Password resets for all VPN users and implementation of stricter access controls.
## Lessons Learned
- **Driver Signature Gaps:** Windows may still load drivers with revoked certificates (like the 2010 EnCase driver), leaving a gap in Driver Signature Enforcement (DSE).
- **SIEM/EDR Correlation:** Detection was only possible by linking edge firewall logs (VPN logins) with internal endpoint behavior (reconnaissance and driver loading).
## Recommendations
- **Enforce MFA:** Ensure Multi-Factor Authentication is strictly required for all SSLVPN connections.
- **VPN Hardening:** Restrict VPN access via IP allow-listing where possible and disable the web portal if not required.
- **Driver Blocklisting:** Implement Microsoft’s recommended driver blocklist or use Windows Defender Application Control (WDAC) to prevent the loading of known vulnerable/revoked drivers.
- **Monitor for BYOVD:** Configure security tools to alert on the installation of kernel-mode services, especially those associated with legacy or forensic software.