Qilin Ransomware and the Hidden Dangers of BYOVD

Updated September 14, 2026

Key Takeaways

• Qilin ransomware used BYOVD to bypass EDR protections. The attackers abused the vulnerable signed driver TPwSav.sys to gain kernel-level capabilities and interfere with endpoint security controls.
• The attack started with compromised access. The threat actors entered through SSL VPN access, established remote access, and moved through the environment before deploying tools for the EDR bypass.
• EDR alone was not enough to stop the attack. The attackers combined legitimate signed software, a vulnerable driver, custom tooling, and kernel-level techniques to evade endpoint protections.
• MSP credentials were involved. The incident highlights the additional risk created when compromised service-provider credentials can be used to access customer environments.
• Blackpoint detected and contained the activity before encryption. The SOC isolated affected systems and stopped the attack before the Qilin ransomware could complete its deployment.
• BYOVD remains a serious security concern. Defending against these attacks requires visibility into credentials, remote access, lateral movement, driver activity, and other behaviors that can indicate an attack is progressing.

Cybercriminals continue to employ sophisticated tactics intended to evade traditional Endpoint Detection and Response (EDR), while maintaining a low profile and limiting the noise created by these activities.

A recent incident involving Qilin ransomware highlighted the evolving tactics of cybercriminals and the effectiveness of proactive defense.

It’s important to understand the nefarious tooling and methodology now being leveraged, due to historical organizational reliance on traditional EDR and the false sense of security it can create.

In this blog, we will unpack how Qilin ransomware affiliates leveraged a previously unknown driver, TPwSav.sys, to stealthily disable EDR measures, a technique known as bring-your-own-vulnerable-driver (BYOVD).

We’ll walk through the entire attack chain, from the initial compromise using stolen credentials to the final attempt at deploying ransomware. Most importantly, we’ll explain how Blackpoint Cyber Security Operations Center (SOC)‘s rapid isolation of impacted systems and layered security approach thwarted the attackers’ tactics.

What Is Qilin Ransomware?

Qilin (aka: Agenda) ransomware was first observed in July 2022. It operates through a double extortion method, where victims’ data is stolen and leaked via a data leak site (pictured below) if the ransom demand is not paid.

Qilin maintains variants written in both Golang and Rust, and targets both Windows and Linux operating systems. It operates as a ransomware-as-a-service (RaaS), with affiliates earning 80% of ransom payments under $3 million and 85% of payments over $3 million.

Qilin affiliates have been observed gaining initial access via social engineering attacks such as phishing emails with malicious attachments and valid credentials that have been leaked and/or purchased.

A purported recruiter for the Qilin operation posted on a Russian-language cybercriminal forum advertising the RaaS and offering positions to qualified affiliates, stating that affiliates are not allowed to target Commonwealth of Independent States (CIS) countries. This rule is commonly observed in ransomware operations.

The Qilin panel gives affiliates extensive customization, indicating the ransomware is tailored for each victim. Affiliates can create and edit data-leak blog posts about companies that haven’t paid, create accounts for team members, and access support. Operators can customize which directories, files, and processes to skip or kill, the encryption mode, and which VMs to leave running.

The Linux variant is compiled with GCC 11 in the ELF64 format and is 1.32MB in size. Like the Windows variant, it provides a number of options to ensure the right files are encrypted.

Qilin offers multiple encryption methods, configurable through the panel. One option uses AES-256 to encrypt files and RSA-2048 to encrypt the generated key, then appends a new random extension. The Linux version uses OpenSSL, with the public key hardcoded at address 0x004EB3A8 and loaded via the statically linked OpenSSL library.

Recent Qilin Ransomware Attacks

In August 2024, security researchers with Sophos reported that the Qilin ransomware group targeted a victim via compromised credentials. The dwell time in the victim’s environment was 18 days. The operators edited the domain policy to introduce a logon-based Group Policy Object (GPO) containing two items: a PowerShell script, IPScanner.ps1, and a batch script, logon.bat.

The combination of the two scripts harvested credentials saved in Chrome browsers on machines connected to the network. This suggests Qilin is likely shifting tactics toward credential harvesting rather than exfiltrating large amounts of victim-specific data.

In October 2024, Halcyon security researchers reported a new, updated variant dubbed “Qilin.B.” Written in Rust, it supports AES-256-CTR encryption for systems with Advanced Encryption Standard New Instructions (AES-NI) capabilities, and uses RSA-4096 with Optimal Asymmetric Encryption Padding (OAEP) to safeguard encryption keys.

Qilin.B also added new defense evasion techniques. It still terminates services associated with security tools and clears Windows Event Logs, and now also deletes itself to reduce any indication the malware was there.

Blackpoint’s Security Operations Center (SOC) has encountered at least two incidents involving Qilin ransomware. In both cases, Blackpoint’s SOC prevented encryption by isolating impacted devices and working with partners to mitigate the threat.

Historical Targeting

Qilin has listed 164 victims on their data leak site, with most of those victims being in the Industrials (Construction & Engineering) vertical. Qilin’s ransomware has targeted victims worldwide, with most of their reported victims in North America.

The following graphs show the victims that were named on Qilin’s data leak site by industry and location. The number of victims is likely higher when you include victims who paid the ransom and/or didn’t disclose the ransomware attack.

Attack Chain

The victim’s SSL VPN logs indicated a connected session from IP address 31.192.107[.]144 that began on December 12, 2024, and lasted over 6 hours. Another session began later that day and lasted an additional hour and a half. The IP belongs to the cloud service provider HOSTKEY, based in Russia.

On one machine, an executable named main.exe opened a reverse proxy to the IP 216.120.203[.]26 via secure shell (SSH). The IP belongs to the cloud hosting provider Shock Hosting. Written in Golang, the main.exe executable leveraged several open-source networking libraries with the simple purpose of exposing a remote tunnel into the network. The attacker proceeded to connect to internal machines using the Remote Desktop Protocol (RDP) and remote management tools.

The attacker deployed a legitimate signed executable named upd.exe which sideloads a malicious dynamic link library (DLL) named avupdate.dll. The DLL was responsible for decoding and loading a customized version of the EDR-killing tool named EDRSandblast.

Blackpoint’s Analysis of Qilin

When the ransomware is executed from the command line with the correct password, it outputs debug statements detailing each step of its operation. The sample also contains an embedded target account email address and password, which were used for initial access and lateral movement. Notably, the embedded account credentials belong to the managed service provider (MSP) associated with the targeted customer.

The image below is a sample ransom note of the Qilin.B variant.

EDR Bypass Analysis

The following depicts how the ransomware successfully executed and bypassed the installed EDR before Blackpoint’s SOC prevented any further harm.

There were several files involved in the attack, including files named upd.exe, avupdate.dll, web.dat and TPwSav.sys.

The upd.exe portable executable (PE) is the Carbon Black Cloud Sensor AV update tool. In a normal setting, it loads a dynamic link library (DLL) named avupdate.dll to perform various update functions. In this case, the avupdate.dll sample contained malicious code.

An exported function from avupdate.dll named avupdate_get_version is tasked with loading and executing a file called web.dat using dynamically resolved Windows APIs. Additionally, it performs various anti-analysis techniques, such as detecting the presence of a virtual machine and checking if it is being debugged, to evade analysis and hinder reverse engineering efforts.

The web.dat file is a windows PE which is XOR encoded with the byte value 0x6a.

The decoded PE is a customized variant of the tool EDRSandblast, designed to disable EDR products at the kernel level by exploiting a vulnerable signed driver. The tool includes a pre-populated list of kernel module address offsets, enabling it to locate critical functions and data structures within kernel memory.

Rather than relying on one of the standard vulnerable drivers supported by the tool, the threat actor (TA) opted to use a driver named TPwSav.sys. This driver, originally developed for power-saving features on Toshiba laptops, is a signed Windows kernel driver, making it an attractive choice for bypassing EDR protections through a bring-your-own-vulnerable-driver (BYOVD) attack.

TPwSav.sys contains two IO control codes (IOCTLs) mapped to functions which allow arbitrary reading and writing of memory one byte at a time.

Each function maps a physical memory address to its corresponding virtual address using the MmMapIoSpace function. It then either reads a single byte back into the input buffer or modifies it before unmapping the address with MmUnmapIoSpace.

Read-only memory protections can be bypassed by leveraging physical addresses to map virtual addresses and modify their contents. A common technique employed by rootkit authors is to overwrite the address of a legitimate driver’s major function handler with shellcode. Once modified, the handler is invoked, enabling the attacker to hijack its execution flow.

In this case, the TA used these capabilities to overwrite the BeepDeviceControl function in the native Windows driver Beep.sys. The shellcode replacing this function implements a custom handler that processes an IOCTL of 0x222000, providing the ability to perform arbitrary read and write operations on kernel memory.

The HijackBeep function plays a critical role in enumerating essential addresses, including Beep’s base address, the offset of BeepDeviceControl, and the address of IofCompleteRequest. Additionally, it retrieves virtual-to-physical address mappings by querying SystemSuperfetchInformation, specifically through the SuperFetchMemoryRangesQuery. Using the table of virtual-to-physical mappings, the function overwrites the BeepDeviceControl handler with the attacker’s shellcode. Before doing so, it patches the shellcode to include the relative offset to IofCompleteRequest found in the imports table, ensuring seamless execution of the hijacked code path.

Two functions are repeatedly invoked to execute the shellcode, enabling either an arbitrary read or write operation to any specified memory address. The input buffer, 24 bytes in size, includes the following parameters: the target memory address to read from or write to, an operation flag indicating the desired action (read or write), the size of the data to be read or written, and a data buffer that either stores the result of a read operation or contains the data to be written. These functions provide precise control over memory manipulation, facilitating the exploit’s objectives.

The TA proceeds with removing kernel callback routines and kernel event tracing, rendering most EDR solutions ineffective.

As of this writing, there is no public evidence of in-the-wild exploitation involving TPwSav.sys beyond the activity observed by Blackpoint’s SOC. Compiled in 2015 and holding a valid signature, this driver is an appealing candidate for BYOVD attacks aimed at disabling EDR. While interacting with the driver requires only low-level privileges, loading it and enumerating physical memory demand administrative privileges.

By default, the EDRSandblast tool is configured to utilize three known vulnerable drivers that are already flagged as suspicious and likely blocked by most EDR vendors. To circumvent detection, malware authors customizing this tool often replace these drivers with a different vulnerable driver that remains undetected.

Customizing EDRSandblast is not a novel concept, and examples of techniques used to overwrite code sections of Beep.sys with shellcode are publicly available. However, the expertise required to seamlessly integrate these components and execute the attack effectively remains a significant challenge. This was demonstrated by a sophisticated threat actor who successfully implemented the technique, showcasing a high level of skill and deep understanding of the Windows kernel to achieve their objectives.

Considering that the Qilin sample represents a secondary variant distributed to affiliates through a Ransomware-as-a-Service (RaaS) model, it is highly probable that the customized EDR bypass tool was also acquired via dark web marketplaces.

Frequently Asked Questions About Qilin Ransomware

What is Qilin ransomware?

Qilin (also known as Agenda) is a ransomware-as-a-service (RaaS) operation first observed in July 2022. It uses double extortion, stealing data and leaking it on a data leak site if the ransom isn’t paid, and targets both Windows and Linux systems with variants written in Golang and Rust.

Who is behind Qilin ransomware?

Qilin operates as a RaaS, run by a core group that recruits affiliates through cybercriminal forums. Affiliates carry out attacks and earn 80–85% of the ransom, and are instructed not to target Commonwealth of Independent States (CIS) countries.

How does Qilin ransomware bypass EDR?

In the incident Blackpoint analyzed, Qilin affiliates used a bring-your-own-vulnerable-driver (BYOVD) attack, loading a legitimately signed but vulnerable driver (TPwSav.sys) to disable EDR at the kernel level using a customized version of the EDRSandblast tool.

What is Qilin.B?

Qilin.B is an updated variant of Qilin, written in Rust and reported in October 2024. It added stronger encryption (AES-256-CTR with RSA-4096) and new defense-evasion techniques, including clearing Windows Event Logs and deleting itself after execution.

How Blackpoint Protects Against Ransomware Like Qilin

Qilin’s use of BYOVD shows why layered defense and rapid human response matter more than any single tool. Blackpoint’s SOC detected and contained this attack before encryption. Managed detection and response, backed by a 24/7 SOC and managed EDR, helps partners detect and respond to advanced threats like this one, including tradecraft designed to disable traditional EDR.

Qilin Ransomware

The Qilin incident serves as a stark reminder that ransomware operations continue to innovate, exploiting even previously unknown vulnerabilities to bypass robust security measures. The attackers’ skillful use of a stealthy driver-loaded payload underscores the importance of vigilant threat hunting and real-time monitoring.

Nevertheless, Blackpoint’s SOC demonstrated how thorough, coordinated response efforts can successfully halt even the most advanced threats. By swiftly isolating affected systems, investigating malicious activity, and leveraging a defense-in-depth strategy, the team neutralized the ransomware before any significant damage occurred. This case underscores the need for continued vigilance, strong partnerships, and ongoing security investments to stay ahead of rapidly evolving cyber threats.

Hashes

IPs

• 216.120.203[.]26 (Shock Hosting – U.S.)
• 31.192.107[.]144 (HostKey – Russia)

See how Blackpoint disrupts advanced ransomware attacks before they reach their objective.

Request a Demo →