Cisco Talos Reports Microsoft Windows Policy Loophole Being Exploited by Threat Actor
Learn how a malicious driver exploits a loophole in the Windows operating system to run at kernel level. Cisco Talos discovered a new Microsoft Windows policy loophole that allows a threat actor to sign malicious kernel-mode drivers executed by the operating system. The threat actor takes advantage of a specific compatibility policy from Microsoft to enable the signing of malicious kernel-mode drivers. Then, the RedDriver malware, which might be developed by a Chinese-speaking threat actor, targets browsers used primarily in China.
