Abyss Rootkit Analysis: Unmasking Deep-System Threats
ABYSSWORKER: The EDR-Killer Driver Behind MEDUSA Ransomware ABYSSWORKER is a malicious signed Windows kernel driver used in the MEDUSA ransomware attack chain to blind and disable endpoint detection and response tools – masquerading as a CrowdStrike Falcon…
- EDR Killer
- Ransomware
Bottom line. Finding a kernel driver named smuol.sys that claims to be ‘CrowdStrike Falcon’ but is signed with a revoked certificate is a high-severity, pre-encryption warning sign. ABYSSWORKER is deployed to switch off EDR before MEDUSA ransomware detonates – treat any detection as an active intrusion, isolate the host, and hunt for the loader and follow-on ransomware immediately.
Background
Attackers increasingly ‘bring their own driver’ (BYOVD) – abusing a vulnerable legitimate driver or loading a purpose-built malicious one – to reach the Windows kernel and switch off endpoint detection and response (EDR) from below the security stack. ABYSSWORKER is a custom-built example of the second approach.
Elastic Security Labs documented ABYSSWORKER as part of a financially motivated campaign deploying MEDUSA ransomware via a HEARTCRYPT-packed loader. The loader installs the driver, which is then used to target and silence multiple EDR vendors. Elastic assesses the driver is related to the POORTRY family first disclosed by Mandiant in 2022, and a similar EDR-killer was separately reported by ConnectWise.
The driver is a 64-bit Windows PE named smuol.sys that imitates a legitimate CrowdStrike Falcon driver. Samples observed on VirusTotal date from August 2024 to February 2025; most are VMProtect-packed, and all are signed with likely-stolen, revoked certificates from Chinese companies that are widely shared across unrelated malware.
What we observed
Reverse engineering of the driver reveals a comprehensive kernel-mode toolkit purpose-built to dismantle security tooling:
- Signed impersonation: the driver poses as a ‘CrowdStrike Falcon Sensor Driver’ and loads using revoked, likely-stolen Chinese code-signing certificates that are shared across multiple malware families.
- Self-protection: on device open it registers ObRegisterCallback handlers that zero out desired access to its own process and threads, and brute-forces existing handles to strip access – blocking attempts to inspect or kill the client.
- EDR blinding toolkit: DeviceIoControl handlers remove kernel notification callbacks (process/thread/image, ObRegisterCallbacks, CmRegisterCallback), replace a target driver’s major functions with a dummy handler, detach MiniFilter (FltMgr.sys) devices, kill system threads by module, and remove hooks from NTFS/PNP drivers.
- Direct file and process control: it copies and deletes files by crafting raw IRPs sent straight to the drive device (bypassing common APIs), can terminate arbitrary processes and threads by PID/TID, and can force a reboot via the undocumented HalReturnToFirmware. A hardcoded password gates operation (sent via IOCTL 0x222080).
ABYSSWORKER in the MEDUSA chain
Kill the watchdog first: EDR is disabled from the kernel before the ransomware ever runs.
Attribution
Elastic Security Labs links ABYSSWORKER to a financially motivated campaign that deploys MEDUSA ransomware, and assesses the driver is related to the POORTRY malicious-driver family (Mandiant, 2022); a comparable EDR-killer was also reported by ConnectWise. The revoked signing certificates are Chinese but are stolen and widely shared, so they are not a reliable attribution signal on their own. Confidence in the technical behaviour is high; specific operator scope should be confirmed against internal telemetry.
Confidence: 90%.
An EDR-killer doesn’t need a zero-day – a stolen signature and a kernel driver are enough to switch off the alarms before the break-in.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Defense Evasion | Code Signing | T1553.002 | Driver is signed with revoked, likely-stolen certificates from Chinese vendors to load into the kernel and appear trustworthy. |
| Persistence | Create or Modify System Process: Windows Service | T1543.003 | The malicious .sys driver is installed and loaded as a kernel-mode service by the HEARTCRYPT loader. |
| Defense Evasion | Rootkit | T1014 | Kernel-mode client protection hides/guards the operator process and strips handles; Elastic classes it under a Windows_Rootkit YARA signature. |
| Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 | Removes EDR notification callbacks, nulls driver major functions, detaches MiniFilter devices, and kills security system threads. |
| Defense Evasion | File and Directory Permissions Modification | T1222 | Resets file attributes to ATTRIBUTE_NORMAL to unprotect read-only files before deleting them via crafted IRPs. |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
| 6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050 | sha256 | ABYSSWORKER reference sample (VT first seen 2025-01-22) |
| b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505 | sha256 | ABYSSWORKER sample (VT first seen 2025-01-27) |
| \device\czx9umpTReqbOOKF | device object | Device created by the driver on load |
| \??\fqg0Et4KlNt4s1JT | symbolic link | Symbolic link created by the driver |
Detection
Copy-ready hunting query:
# Hunt for the known ABYSSWORKER samples by SHA256
index=edr (sha256="6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050" OR sha256="b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505")
| stats count min(_time) as first_seen values(host) as hosts by file_name, signer
# Behavioural: a driver claiming to be CrowdStrike Falcon that isn't the real signed product
index=edr event=driver_load (original_file_name="smuol.sys" OR file_description="CrowdStrike Falcon*")
| search signer!="CrowdStrike, Inc."
| stats values(image_path) as paths values(signer) as signers by host
# Detection: creation of the driver's device object / symbolic link
index=edr (object_name="\\device\\czx9umpTReqbOOKF" OR object_name="\\??\\fqg0Et4KlNt4s1JT")
# Also deploy Elastic's YARA rule: Windows_Rootkit_AbyssWorkerRecommendations
- Enforce Microsoft’s Vulnerable/Malicious Driver Blocklist and, where feasible, WDAC/HVCI code-integrity policies to stop revoked-cert and known-bad drivers from loading in the first place.
- Alert on EDR tampering itself – sudden telemetry loss, callback/MiniFilter removal, or a driver impersonating CrowdStrike Falcon that is not signed by CrowdStrike – and treat it as a high-priority, pre-ransomware event.
- Block and retrospectively hunt the listed SHA256 hashes and the driver’s device/symbolic-link artifacts across EDR/AV; deploy Elastic’s Windows_Rootkit_AbyssWorker YARA rule.
- Because ABYSSWORKER precedes MEDUSA encryption, trigger full IR on detection: isolate the host, preserve memory, hunt for the HEARTCRYPT loader and lateral movement, and rotate credentials on affected systems.
