How a Tax Search Leads to Kernel-Mode AV/EDR Kill
A large-scale malvertising campaign targeting U.S. tax form searchers has been uncovered. The attack chain begins with Google Ads, using dual commercial cloaking services to evade detection. Victims are directed to rogue ScreenConnect installers, leading to a multi-stage crypter that ultimately deploys a BYOVD (Bring Your Own Vulnerable Driver) tool. This tool, named HwAudKiller, exploits a previously undocumented Huawei audio driver to terminate antivirus and EDR processes from kernel mode. The campaign's sophistication lies in its use of commodity tools and services, combining free-tier ScreenConnect instances, off-the-shelf crypters, and a signed driver with an exploitable weakness. The attackers consistently deploy multiple remote access tools on compromised hosts for redundancy, indicating a likely pre-ransomware or initial access broker operation.
Pulse ID: 69bc8d909b5c7bee4ed80899
Pulse Link: https://otx.alienvault.com/pulse/69bc8d909b5c7bee4ed80899
Pulse Author: AlienVault
Created: 2026-03-19 23:58:08
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #EDR #ELF #Google #GoogleAds #InfoSec #Malvertising #OTX #OpenThreatExchange #RAT #RansomWare #ScreenConnect #bot #AlienVault