BYOVD Attack Exploits Vulnerable OPSWAT Driver to Blind Security Tools in Cambodia Campaign
This campaign demonstrates the growing abuse of the Bring Your Own Vulnerable Driver (BYOVD) technique, where attackers deliberately introduce a legitimate but unpatched driver to gain kernel-level privileges and disable endpoint security software. The root failure lies in organizations not maintaining inventories of approved drivers and not blocking known-vulnerable drivers from loading. By weaponizing a signed, trusted driver, attackers effectively bypass conventional security controls that would otherwise flag malicious binaries. This matters because once security tools are disabled at the kernel level, the attacker operates with near-impunity, making detection and response extremely difficult. The use of legitimate signed executables (Tencent) further illustrates how trust in signed software can be exploited when proper allow-listing policies are absent.
Tactical Insight
Immediate actions
- Deploy Microsoft's Vulnerable Driver Blocklist (or equivalent) and ensure it is enforced via Windows Defender Application Control (WDAC) or equivalent policy.
- Audit all third-party drivers currently loaded on endpoints and remove or quarantine any that appear on known-vulnerable driver lists (e.g., LOLDrivers.io).
- Apply available patches for the vulnerable OPSWAT driver immediately across all affected systems.
Long-term improvements
- Maintain a continuously updated approved-driver inventory and enforce strict allow-listing to prevent unauthorized or vulnerable drivers from loading.
- Implement kernel-level tamper protection for security tools so they cannot be disabled by third-party drivers.
- Establish a formal BYOVD threat-hunting program that regularly checks for known-vulnerable driver hashes in the environment.
Detection measures
- Enable kernel driver load event logging (e.g., Sysmon Event ID 6) and alert on any driver load that matches known-vulnerable hashes.
- Monitor for suspicious use of signed executables from unexpected vendors (e.g., Tencent binaries appearing in non-standard paths) as potential LOLBin abuse.
- Integrate threat intelligence feeds covering BYOVD campaigns to proactively block emerging vulnerable driver signatures at the endpoint and perimeter.