Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Qilin and Warlock ransomware groups are leveraging the BYOVD (Bring Your Own Vulnerable Driver) technique to disable over 300 EDR security tools on compromised systems.

• •Qilin deploys a malicious DLL (msimg32.dll) via DLL side-loading that uses two vulnerable drivers: rwdrv.sys (memory access) and hlpdrv.sys (EDR process termination)
• •The loader evades detection by neutralizing user-mode hooks, suppressing ETW event logs, and executing the EDR killer payload entirely in memory
• •Qilin has been the most active ransomware group recently, responsible for 16.4% of ransomware incidents in Japan in 2025, with ransomware execution occurring ~6 days after initial compromise
• •Warlock exploits unpatched SharePoint servers and uses NSecKrnl.sys driver in BYOVD attacks, alongside tools like TightVNC, PsExec, Velociraptor, Cloudflare Tunnel, and Rclone