A DDoS mitigation service provider in Europe was targeted in a massive distributed denial-of-service attack that reached 1.5 billion packets per second.

The attack originated from thousands of IoTs and MikroTik routers, and it was mitigated by FastNetMon, a company that offers protection against service disruptions.

“The attack reached 1.5 billion packets per second (1.5 Gpps) — one of the largest packet-rate floods publicly disclosed,” FastNetMon says in a press release.

“The malicious traffic was primarily a UDP flood launched from compromised customer-premises equipment (CPE), including IoT devices and routers, across more than 11,000 unique networks worldwide,” the company explains.

FastNetMon did not name the targeted customer, but describes it as a DDoS scrubbing provider. These services specialize in filtering out malicious traffic during DDoS attacks through packet inspection, rate limiting, CAPTCHA, and anomaly detection.

The attack was detected in real-time, and mitigation action was taken using the customer’s DDoS scrubbing facility. The measures included deploying access control lists (ACLs) on edge routers known for amplification capabilities.

News of the attack comes just days after internet infrastructure giant Cloudflare announced that it blocked the largest recorded volumetric DDoS attack in history, which peaked at 11.5 terabits per second (Tbps) and 5.1 billion packets per second (Bpps).

In both attacks, the goal was to exhaust processing abilities on the receiving end and cause service outages.

FastNetMon’s founder, Pavel Odintsov, commented that the trend of these massive attacks has become very dangerous, and intervention at the internet service provider (ISP) level is required to stop this mass-scale weaponization of compromised consumer hardware.

“What makes this case remarkable is the sheer number of distributed sources and the abuse of everyday networking devices. Without proactive ISP-level filtering, compromised consumer hardware can be weaponised at a massive scale” – FastNetMon

“The industry must act to implement detection logic at the ISP level to stop outgoing attacks before they scale,” says Odintsov.

Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines.

The abused driver is ‘rwdrv.sys’ (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access.

This driver is likely used to load a second driver, ‘hlpdrv.sys,’ a malicious tool that manipulates Windows Defender to turn off its protections.

This is a ‘Bring Your Own Vulnerable Driver’ (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender.

“The second driver, hlpdrv.sys, is similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,” explain the researchers.

“The malware accomplishes this via execution of regedit.exe.”

This tactic was observed by Guidepoint Security, which reports seeing repeated abuse of the rwdrv.sys driver in Akira ransomware attacks since July 15, 2025.

“We are flagging this behavior because of its ubiquity in recent Akira ransomware IR cases. This high-fidelity indicator can be used for proactive detection and retroactive threat hunting,” continued the report.

To help defenders detect and block these attacks, Guidepoint Security has provided a YARA rule for hlpdrv.sys, as well as complete indicators of compromise (IoCs) for both drivers, their service names, and file paths where they are dropped.

Akira attacks on SonicWall SSLVPN

Akira ransomware was recently linked to attacks on SonicWall VPNs using what is believed to be an unknown flaw.

Guidepoint Security says it could neither confirm nor debunk the exploitation of a zero-day vulnerability in SonicWall VPNs by Akira ransomware operators.

In response to reports about elevated offensive activity, SonicWall advised disabling or restricting SSLVPN, enforcing multi-factor authentication (MFA), enabling Botnet/Geo-IP protection, and removing unused accounts.

Meanwhile, The DFIR Report has published an analysis of recent Akira ransomware attacks, highlighting the use of the Bumblebee malware loader delivered via trojanized MSI installers of IT software tools.

An example involves searches for “ManageEngine OpManager” on Bing, where SEO poisoning redirected the victim to the malicious site opmanager[.]pro.

Bumblebee is launched via DLL sideloading, and once C2 communication is established, it drops AdaptixC2 for persistent access.

The attackers then conduct internal reconnaissance, create privileged accounts, and exfiltrate data using FileZilla, while maintaining access via RustDesk and SSH tunnels.

After approximately 44 hours, the main Akira ransomware payload (locker.exe) is deployed to encrypt systems across domains.

Until the SonicWall VPN situation clears up, system administrators should monitor for Akira-related activity and apply filters and blocks as indicators emerge from security research.

It is also strongly advised to only download software from official sites and mirrors, as impersonation sites have become a common source for malware.

A new tool called ‘Defendnot’ can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.

The trick utilizes an undocumented Windows Security Center (WSC) API that antivirus software uses to tell Windows it is installed and is now managing the real-time protection for the device.

When an antivirus program is registered, Windows automatically disables Microsoft Defender to avoid conflicts from running multiple security applications on the same device.

The Defendnot tool, created by researcher es3n1n, abuses this API by registering a fake antivirus product that meets all of Windows’ validation checks.

The tool is based on a previous project called no-defender, which used code from a third-party antivirus product to spoof registration with WSC. That earlier tool was pulled from GitHub after the vendor filed a DMCA takedown.

“Then, after a few weeks after the release, the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request and I didn’t really want to do anything with that so just erased everything and called it a day,” the developer explains in a blog post.

Defendnot avoids copyright issues by building the functionality from scratch through a dummy antivirus DLL.

Normally, WSC API is safeguarded through Protected Process Light (PPL), valid digital signatures, and other features.

To bypass these requirements, Defendnot injects its DLL into a system process, Taskmgr.exe, that is signed and already trusted by Microsoft. From within that process, it can register the dummy antivirus with a spoofed display name.

Once registered, Microsoft Defender immediately shuts itself off, leaving no active protection on the device.

The tool also includes a loader that passes configuration data via a ctx.bin file and lets you set the antivirus name you want to use, turn off registration, and enable verbose logging.

For persistence, Defendnot creates an autorun through the Windows Task Scheduler so that it starts when you log in to Windows.

While Defendnot is considered a research project, the tool demonstrates how trusted system features can be manipulated to turn off security features.

Microsoft Defender is currently detecting and quarantining Defendnot as a ‘Win32/Sabsik.FL.!ml; detection.

Microsoft is testing a new Defender for Endpoint capability that will block traffic to and from undiscovered endpoints to thwart attackers’ lateral network movement attempts.

As the company revealed earlier this week, this is achieved by containing the IP addresses of devices that have yet to be discovered or onboarded to Defender for Endpoint.

Redmond says the new feature will prevent threat actors from spreading to other non-compromised devices by blocking incoming and outgoing communication with devices using contained IP addresses.

“Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through automatic attack disruption. The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded,” Microsoft explains.

“Through automatic attack disruption, Defender for Endpoint incriminates a malicious device, identifies the role of the device to apply a matching policy to automatically contain a critical asset. The granular containment is done by blocking only specific ports and communication directions.”

This new feature will be available on Defender for Endpoint-onboarded devices running Windows 10, Windows 2012 R2, Windows 2016, and Windows Server 2019+.

Admins can also stop an IP address’s containment by restoring its connection to the network at any time by selecting the “Contain IP“ action in the “Action Center” and selecting “Undo” in the flyout.

Since June 2022, Defender for Endpoint has also been able to isolate hacked and unmanaged Windows devices, blocking all communication to and from the compromised devices to stop attackers from spreading through victims’ networks.

Microsoft also started testing device isolation support for Defender for Endpoint on onboarded Linux devices, with the capability reaching general availability on macOS and Linux in October 2023.

The same month, the company revealed that Defender for Endpoint could also isolate compromised user accounts to block lateral movement in hands-on-keyboard ransomware attacks using automatic attack disruption.