Solved Hackers can bypass Microsoft Defender

XxXxX · Aug 7, 2025

Hackers can bypass Microsoft Defender to install ransomware on PCs by exploiting a legitimate driver, hackers can load their own malicious driver to bypass Microsoft Defender.

Hackers can bypass Microsoft Defender to install ransomware on PCs

By exploiting a legitimate driver, hackers can load their own malicious driver to bypass Microsoft Defender.

www.pcworld.com

be careful out there.
best of luck, Steve ..

KevTech · Aug 7, 2025

Looks to be an Intel issue.

This is done by exploiting a vulnerable driver called rwdrv.sys, which is a legitimate driver used by an Intel CPU tuning tool called ThrottleStop.

neemobeer · Aug 7, 2025

Some ransonware operators actually release a ranking of EDR tools and ease to bypass. Rankings go from S (hard) to LOL you can guess. Defender is consistenly in the LOL ranking.

garlin · Aug 7, 2025

KevTech said:
Looks to be an Intel issue.

ThrottleStop is a well-known CPU tuning tool from TechPowerUp. It's generally considered safe, but as always 3rd-party drivers are prone to vulnerabilities.

MS can address the problem in two different ways:

Ban it outright in Defender by a definitions update
Ban the driver in the next CU by updating the SiPolicy_Enforced.p7b (Vulnerable Drivers Blocklist)

Since the existing driver has a specific SHA1/SHA256 hash, MS can permit a safer driver version once they've proven the hole has been fixed. MS bans a ton of ASUS utilities for the same reason, terrible kernel driver security.

Marcus Vinicus · Aug 7, 2025

I wonder how many users have ThrottleStop on their computers? I would doubt it has widespread use.
More reporting here:

This devious ransomware is able to hijack your system to turn off antivirus

Akira deploys its malware in a devilishly clever way

www.techradar.com

OAT · Aug 7, 2025

neemobeer said:
Some ransonware operators actually release a ranking of EDR tools and ease to bypass. Rankings go from S (hard) to LOL you can guess. Defender is consistenly in the LOL ranking.

AV-TEST confirms Windows Defender is amongst the very finest antiviruses you get in 2021

German security research institute AV-TEST has released its October 2021 Windows 10 report for anti-virus assessment. Among the programs tested here, Microsoft's Windows Defender has done very well.

www.neowin.net

Defender is the only AV/MW software I use on all my systems, never had a single issue.
And we all know that neowin is not exactly pro-windows.
Anyone that uses LOL as a rating in itself is quite laughable.

Marcus Vinicus · Aug 7, 2025

OAT said:
Anyone that uses LOL as a rating in itself is quite laughable.

In independent testing of AV software Defender generally doesn't always compete against the top 3rd party AV suites, but isn't the worst.

neemobeer · Aug 7, 2025

There are at least 10 ways to bypass defender even with it enabled and running. The rating from from actual ransomware operators

.

Saying nothing bad ever happened with just running Defender or any other detection/protection software doesn't guarantee protection. Plenty of opportunity for false negatives.

OAT · Aug 7, 2025

Marcus Vinicus said:
In independent testing of AV software Defender generally doesn't always compete against the top 3rd party AV suites, but isn't the worst.

There is no magic formula though as the user has his part to play as well, whether the AV is correctly set or the sites visited are questionable.
Plus there is the cost associated with 3rd party AV, especially with renewable subscriptions.
Whatever the case may be, I think Defender is still a solid product and there is no doubt its competitors are among the first to cry wolf.

OAT · Aug 7, 2025

neemobeer said:
Saying nothing bad ever happened with just running Defender or any other detection/protection software doesn't guarantee protection. Plenty of opportunity for false negatives.

Nothing in the AV software world guarantees protection, you are right indeed.
I'll carry on taking my chances and stick to Defender; it has served me well, and costs nothing.

Microsoft Pays Security Researchers Record $17 Million to Find Vulnerabilities

Microsoft has awarded a record $17 million to 344 security researchers across 59 countries through its Bounty Program, the highest total in the program’s

winaero.com

neves · Aug 7, 2025

ThrottleStop dev is aware of this issue and intending to update the vulnerable drivers: ThrottleStop.sys Driver Vulnerability

Marcus Vinicus · Aug 7, 2025

Someone may have already pointed this out but MS updates Defender's virus definitions constantly and have probably already blocked this vulnerability.

More info on the vulnerability.

https://www.cve.org/cverecord?id=CVE-2025-7771

oldschool · Aug 7, 2025

Clickbait. Word!

garlin · Aug 7, 2025

Just as a reminder for the casual reader: You're only vulnerable if you installed the ThrottleUp tool, and haven't uninstalled it. Otherwise, this vulnerability doesn't affect you.

PC World's headline is trying scare far too many users.

echo2446 · Aug 8, 2025

Here's the original article: GRITREP: Observed Malicious Driver Use Associated with Akira SonicWall Campaign

By the time this report was published, I think many AV vendors had already flagged the drivers:

VirusTotal

www.virustotal.com

The article did mention:

The Akira ransomware group probably used the above driver (and one other) in combination with SonicWall VPN exploitation.
The drivers are tagged as "Bring Your Own Vulnerable Driver," meaning the attacker actually brought, installed, and registered the driver.

I don't have SonicWall appliances or VPN installed on my home network (

), so I am not worried. By the time this article came out to worry me, Windows Defender probably flagged the above driver anyway.

ps: Saying that a malware can bypass Microsoft security doesn't say much; if it doesn't, how is it going to infect Windows?

Solved Hackers can bypass Microsoft Defender

Just a Computer User

Hackers can bypass Microsoft Defender to install ransomware on PCs by exploiting a legitimate driver, hackers can load their own malicious driver to bypass Microsoft Defender.​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

"No need to be anybody but oneself"

My Computers My Computers

At a glance

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

"No need to be anybody but oneself"

My Computers My Computers

At a glance

At a glance

"No need to be anybody but oneself"

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

Hackers can bypass Microsoft Defender to install ransomware on PCs by exploiting a legitimate driver, hackers can load their own malicious driver to bypass Microsoft Defender.

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer