Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines.

The abused driver is ‘rwdrv.sys’ (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access.

This driver is likely used to load a second driver, ‘hlpdrv.sys,’ a malicious tool that manipulates Windows Defender to turn off its protections.

This is a ‘Bring Your Own Vulnerable Driver’ (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender.

“The second driver, hlpdrv.sys, is similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,” explain the researchers.

“The malware accomplishes this via execution of regedit.exe.”

This tactic was observed by Guidepoint Security, which reports seeing repeated abuse of the rwdrv.sys driver in Akira ransomware attacks since July 15, 2025.

“We are flagging this behavior because of its ubiquity in recent Akira ransomware IR cases. This high-fidelity indicator can be used for proactive detection and retroactive threat hunting,” continued the report.

To help defenders detect and block these attacks, Guidepoint Security has provided a YARA rule for hlpdrv.sys, as well as complete indicators of compromise (IoCs) for both drivers, their service names, and file paths where they are dropped.

Akira attacks on SonicWall SSLVPN

Akira ransomware was recently linked to attacks on SonicWall VPNs using what is believed to be an unknown flaw.

Guidepoint Security says it could neither confirm nor debunk the exploitation of a zero-day vulnerability in SonicWall VPNs by Akira ransomware operators.

In response to reports about elevated offensive activity, SonicWall advised disabling or restricting SSLVPN, enforcing multi-factor authentication (MFA), enabling Botnet/Geo-IP protection, and removing unused accounts.

Meanwhile, The DFIR Report has published an analysis of recent Akira ransomware attacks, highlighting the use of the Bumblebee malware loader delivered via trojanized MSI installers of IT software tools.

An example involves searches for “ManageEngine OpManager” on Bing, where SEO poisoning redirected the victim to the malicious site opmanager[.]pro.

Bumblebee is launched via DLL sideloading, and once C2 communication is established, it drops AdaptixC2 for persistent access.

The attackers then conduct internal reconnaissance, create privileged accounts, and exfiltrate data using FileZilla, while maintaining access via RustDesk and SSH tunnels.

After approximately 44 hours, the main Akira ransomware payload (locker.exe) is deployed to encrypt systems across domains.

Until the SonicWall VPN situation clears up, system administrators should monitor for Akira-related activity and apply filters and blocks as indicators emerge from security research.

It is also strongly advised to only download software from official sites and mirrors, as impersonation sites have become a common source for malware.

A few new code references in the ChatGPT web app and Android point to an Operator-like tool in GPT’s chain of thoughts.

As spotted by Tibor on X, the Android beta has strings like “click,” “drag,” “type,” and even “terminal feed,” which seem to suggest that ChatGPT could soon call a remote browser or sandboxed environment (Operator?).

For those unaware, OpenAI already has Operator, which uses an AI agent to navigate a remote browser session and execute tasks for you.

These references suggest that ChatGPT’s thinking model might call a browser or APIs to execute tasks. There are also references to “Checking available APIs” and “Reading API documentation.”

It’s also worth noting that the code mentions an “intake form,” so OpenAI may gate this feature behind an invite-only beta before rolling it out more widely.

Could it be ChatGPT-5 or some other model? We don’t know, and we likely won’t anytime soon as OpenAI is busy with its standoff with Meta.

A new tool called ‘Defendnot’ can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.

The trick utilizes an undocumented Windows Security Center (WSC) API that antivirus software uses to tell Windows it is installed and is now managing the real-time protection for the device.

When an antivirus program is registered, Windows automatically disables Microsoft Defender to avoid conflicts from running multiple security applications on the same device.

The Defendnot tool, created by researcher es3n1n, abuses this API by registering a fake antivirus product that meets all of Windows’ validation checks.

The tool is based on a previous project called no-defender, which used code from a third-party antivirus product to spoof registration with WSC. That earlier tool was pulled from GitHub after the vendor filed a DMCA takedown.

“Then, after a few weeks after the release, the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request and I didn’t really want to do anything with that so just erased everything and called it a day,” the developer explains in a blog post.

Defendnot avoids copyright issues by building the functionality from scratch through a dummy antivirus DLL.

Normally, WSC API is safeguarded through Protected Process Light (PPL), valid digital signatures, and other features.

To bypass these requirements, Defendnot injects its DLL into a system process, Taskmgr.exe, that is signed and already trusted by Microsoft. From within that process, it can register the dummy antivirus with a spoofed display name.

Once registered, Microsoft Defender immediately shuts itself off, leaving no active protection on the device.

The tool also includes a loader that passes configuration data via a ctx.bin file and lets you set the antivirus name you want to use, turn off registration, and enable verbose logging.

For persistence, Defendnot creates an autorun through the Windows Task Scheduler so that it starts when you log in to Windows.

While Defendnot is considered a research project, the tool demonstrates how trusted system features can be manipulated to turn off security features.

Microsoft Defender is currently detecting and quarantining Defendnot as a ‘Win32/Sabsik.FL.!ml; detection.

A new malware campaign targeting WordPress sites employs a malicious plugin disguised as a security tool to trick users into installing and trusting it.

According to Wordfence researchers, the malware provides attackers with persistent access, remote code execution, and JavaScript injection. At the same time, it remains hidden from the plugin dashboard to evade detection.

Wordfence first discovered the malware during a site cleanup in late January 2025, where it found a modified ‘wp-cron.php’ file, which creates and programmatically activates a malicious plugin named ‘WP-antymalwary-bot.php.’

Other plugin names used in the campaign include:

• addons.php
• wpconsole.php
• wp-performance-booster.php
• scr.php

If the plugin is deleted, wp-cron.php re-creates and reactivates it automatically on the next site visit.

Lacking server logs to help identify the exact infection chain, Wordfence hypothesizes the infection occurs via a compromised hosting account or FTP credentials.

Not much is known about the perpetrators, though the researchers noted that the command and control (C2) server is located in Cyprus, and there are traits similar to a June 2024 supply chain attack.

Once active on the server, the plugin performs a self-status check and then gives the attacker administrator access.

“The plugin provides immediate administrator access to threat actors via the emergency_login_all_admins function,” explains Wordfence in its writeup.

“This function utilizes the emergency_login GET parameter in order to allow attackers to obtain administrator access to the dashboard.”

“If the correct cleartext password is provided, the function fetches all administrator user records from the database, picks the first one, and logs the attacker in as that user.”

Next, the plugin registers an unauthenticated custom REST API route that allows the insertion of arbitrary PHP code into all active theme header.php files, clearing of plugin caches, and other commands processed via a POST parameter.

An updated version of the malware can also inject base64-decoded JavaScript into the site’s

section, likely for serving visitors ads, spam, or redirecting them to unsafe sites.

Apart from file-based indicators like the listed plugins, website owners should scrutinize their ‘wp-cron.php’ and ‘header.php’ files for unexpected additions or modifications.

Access logs containing ’emergency_login,’ ‘check_plugin,’ ‘urlchange,’ and ‘key’ should also serve as red flags, warranting further investigation.