huntress.comwriteupThey Got In Through SonicWall. Then They Tried to Kill | Huntress
Huntress details a February 2026 intrusion beginning with compromised SonicWall SSLVPN credentials, where the attacker deployed an EDR killer that decodes and drops a legitimate but revoked 2006-era EnCase forensic driver (EnPortv.sys, service name OemHwUpd) to terminate 59 different EDR/AV processes from kernel mode via a single IOCTL (KillProc). The write-up explains the driver's novel wordlist-substitution-cipher payload encoding (evading entropy and string-based detection), FNV-1a process-name hashing for fast target matching, timestomping/persistence tricks, and why Windows Driver Signature Enforcement still trusts the expired/revoked certificate due to pre-2015 signing and timestamp exceptions. It closes with concrete mitigations: MFA on VPN, HVCI/Memory Integrity, WDAC vulnerable-driver blocklist rules, and the ASR rule blocking vulnerable signed drivers.
What it is
A Huntress incident (early February 2026) where attackers used compromised SonicWall SSLVPN credentials for initial access, then ran an EDR killer that abuses the Guidance Software (EnCase) forensic kernel driver — a signed driver whose certificate expired in 2010 and was revoked, yet Windows still loads it. Classic BYOVD to terminate security processes from kernel mode. Disrupted before ransomware deployed.
How it works
The dropper is a 64-bit Windows EXE masquerading as a firmware update utility. Its embedded driver is hidden with a wordlist substitution cipher: a 256-word dictionary where each word's array index equals the byte it represents (e.g. block=0x4D, both=0x5A, about=0x00). The payload is a 384,528-byte string of space-separated English words; block both choice about decodes to 4D 5A 90 00 (MZ header). This keeps entropy near ~4 bits/byte, below the 7–8 bits/byte packers trigger, and shows no suspicious strings/APIs.
The decoded driver is written to C:\ProgramData\OEM\Firmware\OemHwUpd.sys, then hidden (hidden+system attributes) and timestomped by copying ntdll.dll timestamps.
Target selection uses FNV-1a hashing (seed 0x811C9DC5) of 59 process names. It enumerates via CreateToolhelp32Snapshot, lowercases each name, hashes, and compares. A kill loop runs every 1 second so restarted security processes are re-terminated.
Preconditions / Affected
Valid SonicWall SSLVPN credentials (the article does not name a CVE — access was via compromised creds). Exploitation of the driver relies on the Driver Signature Enforcement gap that still loads the revoked EnCase driver.
What to do
The page gives indicators rather than commands:
- Dropped driver path:
C:\ProgramData\OEM\Firmware\OemHwUpd.sys(hidden/system, ntdll-matched timestamps) - Attacker IPs:
69.10.60[.]250(successful VPN auth),193.160.216[.]221(denied portal login one minute prior) - SonicWall telemetry proved decisive — ingest VPN auth logs and IPS alerts into a SIEM. Look for ICMP sweeps, NetBIOS probes, SMB SYN floods (>370 SYNs/sec).
- Hunt for/block the revoked EnCase (Guidance Software) driver via WDAC/vulnerable-driver blocklist.
- Correlate a denied portal login immediately followed by successful VPN auth from a different IP.
Caveats
Huntress notes the Huntress agent itself is not among the 59 targeted processes — so on Huntress-protected hosts the killer would not blind that specific agent; do not assume the same for other vendors, all of which are targeted. The fetched text cuts off in the Persistence section, so persistence details are incomplete.
Organisations named here
- EnCase
- EnPortv.sys
- Guidance Software
- OemHwUpd
Technologies named here
- SonicWall SSL VPN
- Huntress Managed SIEM
- Huntress EDR/agent
- Windows
- EnCase forensic driver by Guidance Software
- SonicWall IPS
- EDR killer binary
- 59 endpoint security vendor processes
- CreateToolhelp32Snapshot
- DeviceIoControl / IOCTL interface
- DiE
- Microsoft Vulnerable Driver Blocklist
- WDAC
- EDR
- VPN
- SIEM
- Huntress
- SonicWall
Techniques named here
- BYOVD
- Compromised VPN credential initial access
- Network reconnaissance
- Custom wordlist-based substitution cipher encoding
- FNV-1a hashing for target process matching
- Kernel-mode process termination via IOCTL
- Anti-forensic timestomping
- Hiding dropped driver via file attributes
- Persistence via malicious kernel service registration
- Digital signature timestamp abuse
- Pre-July 29, 2015 kernel driver signing exception abuse
Threat actors named here
- Unnamed threat actor
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
