Dangerous Game in a Malware Attack: Gh0st RAT Secretly Spread Through an Old Windows Driver!

A dangerous game is playing out in the cyber world! Security experts have revealed that an old Windows driver with more than 2,500 different variants has been used in a malware attack. Attackers, using this driver associated with the Adlice company’s RogueKiller software and carrying the version number Truesight.sys 2.0.2, managed to bypass security measures and spread the HiddenGh0st RAT malware.

Driver Exploitation: How Were Firewalls Bypassed?

The most striking aspect of the attack is that attackers created different variants while preserving the driver’s digital signature. In this way, they managed to evade traditional security measures, including Microsoft’s Vulnerable Driver Blocklist.

HiddenGh0st RAT: The Danger of Remote Control and Data Theft

So what does this mean? Attackers can disable security software using these driver variants and install the HiddenGh0st RAT malware on systems. This malware offers attackers capabilities such as remote system control, data theft, and surveillance.

What Is HiddenGh0st RAT?

HiddenGh0st RAT (Remote Access Trojan) is a dangerous piece of malware that allows attackers to gain remote access to target systems, steal files, change system settings, and even spy.

Attack Vector: Fake Applications and Deceptive Websites

The initial-stage malware samples spread through deceptive websites and messaging apps by disguising themselves as legitimate applications. Therefore, you need to be extremely careful when downloading applications from unknown sources.

Geographic Impact: Asia at Risk

Looking at the geographic impact of the attack, the vast majority of victims are in Asia. About 75% of cases have been detected in China.

Microsoft’s Countermove: Driver Blocklist Updated

Microsoft quickly took action against this threat and strengthened its defense mechanisms. The security giant aims to prevent future exploits by adding the vulnerable Truesight.sys driver to its blocklist.

What Should Be Done in the Future? Behavior Analysis and Driver Integrity Checks Are a Must!

This incident once again highlights the need for advanced detection methods that go beyond traditional signature-based approaches. Taking proactive measures such as behavior analysis and driver integrity checks is of great importance to detect malicious driver activity.