Akira ransomware abuses CPU tuning tool to disable Microsoft Defender

stapp · Aug 7, 2025

Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines.
The abused driver is 'rwdrv.sys' (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access.
This driver is likely used to load a second driver, 'hlpdrv.sys,' a malicious tool that manipulates Windows Defender to turn off its protections.
Click to expand...

This is a 'Bring Your Own Vulnerable Driver' (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender.
Click to expand...

https://www.bleepingcomputer.com/ne...pu-tuning-tool-to-disable-microsoft-defender/

stapp · Nov 14, 2025 at 10:09 AM

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued new guidance to organizations on the Akira ransomware operation, which poses an imminent threat to critical sectors.
In an updated advisory produced with the FBI and European law enforcement partners, it said Akira has expanded its capabilities and is now targeting Nutanix AHV virtual machines, an evolution from its previous attacks against VMware ESXi and Hyper-V.
Click to expand...

Nutanix's hypervisors are among the market leaders and are typically used in sectors such as healthcare, finance, and government.
Click to expand...

https://www.theregister.com/2025/11/14/cisa_akira_ransomware/

Log in or Sign up

Akira ransomware abuses CPU tuning tool to disable Microsoft Defender

stapp Global Moderator

stapp Global Moderator

Log in or Sign up

Akira ransomware abuses CPU tuning tool to disable Microsoft Defender

stapp Global Moderator

stapp Global Moderator

Useful Searches