'The main binary acts as a universal loader that allows the attackers to directly load a second-stage unsigned kernel module,' the researchers explained. It further periodically polls the server to retrieve more payloads and load them directly into memory after decoding and decrypting the received data, effectively functioning as a stealthy kernel driver loader that can bypass detections. In subsequent steps, the first-stage driver disables the User Account Control ( UAC) and Secure Desktop mode by editing the registry and initializes Winsock Kernel ( WSK) objects for initiating network communication with the remote server.

Trend Micro's analysis of some of the samples has revealed the presence of debug messages in the source code, indicating that the operation is still in the development and testing phase. Multiple variants of the rootkit spanning eight different clusters have been discovered, with 75 such drivers signed using Microsoft's WHQL program in 20. 'Their malware seems to have passed through the Windows Hardware Quality Labs (WHQL) process for getting a valid signature.' 'This malicious actor originates from China and their main victims are the gaming sector in China,' Trend Micro's Mahmoud Zohdy, Sherif Magdy, and Mohamed Fahmy said. Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came to light in October 2021. Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that's engineered to communicate with an actor-controlled attack infrastructure.

Hacks for critical ops android