Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines.

The abused driver is ‘rwdrv.sys’ (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access.

This driver is likely used to load a second driver, ‘hlpdrv.sys,’ a malicious tool that manipulates Windows Defender to turn off its protections.

This is a ‘Bring Your Own Vulnerable Driver’ (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender.

“The second driver, hlpdrv.sys, is similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,” explain the researchers.

“The malware accomplishes this via execution of regedit.exe.”

This tactic was observed by Guidepoint Security, which reports seeing repeated abuse of the rwdrv.sys driver in Akira ransomware attacks since July 15, 2025.

“We are flagging this behavior because of its ubiquity in recent Akira ransomware IR cases. This high-fidelity indicator can be used for proactive detection and retroactive threat hunting,” continued the report.

To help defenders detect and block these attacks, Guidepoint Security has provided a YARA rule for hlpdrv.sys, as well as complete indicators of compromise (IoCs) for both drivers, their service names, and file paths where they are dropped.

Akira attacks on SonicWall SSLVPN

Akira ransomware was recently linked to attacks on SonicWall VPNs using what is believed to be an unknown flaw.

Guidepoint Security says it could neither confirm nor debunk the exploitation of a zero-day vulnerability in SonicWall VPNs by Akira ransomware operators.

In response to reports about elevated offensive activity, SonicWall advised disabling or restricting SSLVPN, enforcing multi-factor authentication (MFA), enabling Botnet/Geo-IP protection, and removing unused accounts.

Meanwhile, The DFIR Report has published an analysis of recent Akira ransomware attacks, highlighting the use of the Bumblebee malware loader delivered via trojanized MSI installers of IT software tools.

An example involves searches for “ManageEngine OpManager” on Bing, where SEO poisoning redirected the victim to the malicious site opmanager[.]pro.

Bumblebee is launched via DLL sideloading, and once C2 communication is established, it drops AdaptixC2 for persistent access.

The attackers then conduct internal reconnaissance, create privileged accounts, and exfiltrate data using FileZilla, while maintaining access via RustDesk and SSH tunnels.

After approximately 44 hours, the main Akira ransomware payload (locker.exe) is deployed to encrypt systems across domains.

Until the SonicWall VPN situation clears up, system administrators should monitor for Akira-related activity and apply filters and blocks as indicators emerge from security research.

It is also strongly advised to only download software from official sites and mirrors, as impersonation sites have become a common source for malware.

Security researcher Yohanes Nugroho has released a decryptor for the Linux variant of Akira ransomware, which utilizes GPU power to retrieve the decryption key and unlock files for free.

Nugroho developed the decryptor after being asked for help from a friend, deeming the encrypted system solvable within a week, based on how Akira generates encryption keys using timestamps.

The project ended up taking three weeks due to unforeseen complexities, and the researcher spent $1,200 on GPU resources to crack the encryption key, but eventually, he succeeded.

Using GPUs to brute force keys

Nugroho’s decryptor does not work like a traditional decryption tool where users supply a key to unlock their files.

Instead, it brute-forces encryption keys (unique for each file) by exploiting the fact that the Akira encryptor generates its encryption keys based on the current time (in nanoseconds) as a seed.

An encryption seed is data used with cryptographic functions to generate strong, unpredictable encryption keys. Since the seed influences the key generation, keeping it secret is critical to prevent attackers from recreating encryption or decryption keys through brute force or other cryptographic attacks.

Akira ransomware dynamically generates unique encryption keys for each file using four different timestamp seeds with nanosecond precision and hashes through 1,500 rounds of SHA-256.

These keys are encrypted with RSA-4096 and appended at the end of each encrypted file, so decrypting them without the private key is hard.

The level of timing precision in the timestamps creates over a billion possible values per second, making it difficult to brute force the keys.

Also, Nugroho says that Akira ransomware on Linux encrypts multiple files simultaneously using multi-threading, making it hard to determine the timestamp used and adding further complexity.

The researcher narrowed down the possible timestamps to brute-force by looking at log files shared by his friend. This allowed him to see when the ransomware was executed, the file metadata to estimate the encryption completion times, and produce encryption benchmarks on different hardware to create predictable profiles.

Initial attempts using an RTX 3060 were far too slow, with a ceiling of only 60 million encryption tests per second. Upgrading to an RTC 3090 didn’t help much either.

Eventually, the researcher turned to using RunPod & Vast.ai cloud GPU services that offered enough power at the right price to confirm the effectiveness of his tool.

Specifically, he used sixteen RTX 4090 GPUs to brute-force the decryption key in roughly 10 hours. However, depending on the amount of encrypted files that need recovery, the process may take a couple of days.

The researcher noted in his write-up that GPU experts could still optimize his code, so performance can likely be improved.

Nugroho has made the decryptor available on GitHub, with instructions on how to recover Akira-encrypted files.

As always, when attempting to decrypt files, make a backup of the original encrypted files, as there’s a possibility that files can be corrupted if the wrong decryption key is used.

BleepingComputer has not tested the tool and cannot guarantee its safety or effectiveness, so use it at your own risk.