The Gentlemen ransomware showed how dangerous the old problem of Windows with vulnerable drivers has become. In the Ecle-investigated attack, the group did not try to “dispute” the defense at the level of conventional processes, but rose lower to the nucleus of the system, and through an unknown vulnerability turned off EDR before launching the ransomware.
The Gentlemen appeared in the summer of 2025 and quickly relied on BYOVD, a reception in which attackers bring a legitimate but vulnerable driver to an infected machine. Windows trusts this component, the driver gets a high level of access, and attackers use an error in the code to break the security mechanisms from the inside. ESET previously described The Gentlemen a separate set of EDR-builders GentleKiller, and Expel has now disassembled a new episode, where the driver ktapi.sys from Kontron went into business.
According to Expel, at the time of the analysis, the vulnerability in ktap.sys did not appear in public lists of dangerous drivers. The researchers also did not find public cases of the operation of this driver before the publication of the report. The main question remains the main question of how ransomware received the file itself and learned about the weakness in his logic.
Weakness was in the work of the driver with physical memory. ktapi.sys had to help the application code communicate with the equipment, but one of the functions allowed to transfer the address to the system and display the desired memory area in the process of the attacker. With certain parameters, the HalTranslateBusAddress function took not only the addresses of the hardware bus, but also arbitrary addresses in RAM. As a result, the malware was able to read and change the memory of the kernel.
Next, the exploit acted as a highly qualified tool. The code scanned RAM, found tables of the current process pages, translated the kernel virtual addresses into physical and bypassed Windows’s security mechanisms, including PatchGuard, SMAP and SMEP. The exploit developers used the features of Win32k.sys to redirect individual system calls and run the necessary functions with the rights of the kernel without triggering an immediate system failure.
After adjusting such a mechanism, the attackers had to solve the practical problem, to kill the processes of protective products. The exploit turned to the functions of the PsLookupProcessProcessProcessPrycess, ObDerealenceObject and PsTerminateProcess, found the necessary processes and completed them even with the mechanisms of self-defense. In the version, which Expel studied, the list of targets included Microsoft Defender, ESET, Palo Alto Cortex XDR and SentinelOne. The code ran the cycle over and over again, so the EDR could not restart normally after the process was completed.
Expel separately emphasizes that ktapi.sys refers to old cross-signed drivers. In the new builds of Windows 11 25H2 and Windows Server 2025, Microsoft has disabled automatic trust in such outdated drivers, and a specific ktapi.sys in this mode should be blocked without the administrator’s manual permission. However, researchers warn that the latest version of Windows alone does not close the entire class of BYODVD attacks.
As a protection, Expel recommends that kernel and VBS insulation be included, use vulnerable drivers locking, and configure Windows Defender Application Control. The latter mechanism allows you to build a list of allowed drivers by name, hash, publisher certificate and minimum version, which means reduces the risk of rollback to the old vulnerable component. For older systems, the researchers advise adding ktapi.sys and bound to payload was.exe to detection rules, but not rely only on hash, as attackers may have other versions of the same driver.
The main conclusion from the report is unpleasant for corporate protection. Modern EDR can see malicious actions well in user mode, but the vulnerable driver opens the attacking path to the level, where the protective product itself turns into a normal process under the gun of the kernel. For ransomware, this approach became not exotic, but a working way to prepare the system for encryption in seconds.
The Gentlemen appeared in the summer of 2025 and quickly relied on BYOVD, a reception in which attackers bring a legitimate but vulnerable driver to an infected machine. Windows trusts this component, the driver gets a high level of access, and attackers use an error in the code to break the security mechanisms from the inside. ESET previously described The Gentlemen a separate set of EDR-builders GentleKiller, and Expel has now disassembled a new episode, where the driver ktapi.sys from Kontron went into business.
According to Expel, at the time of the analysis, the vulnerability in ktap.sys did not appear in public lists of dangerous drivers. The researchers also did not find public cases of the operation of this driver before the publication of the report. The main question remains the main question of how ransomware received the file itself and learned about the weakness in his logic.
Weakness was in the work of the driver with physical memory. ktapi.sys had to help the application code communicate with the equipment, but one of the functions allowed to transfer the address to the system and display the desired memory area in the process of the attacker. With certain parameters, the HalTranslateBusAddress function took not only the addresses of the hardware bus, but also arbitrary addresses in RAM. As a result, the malware was able to read and change the memory of the kernel.
Next, the exploit acted as a highly qualified tool. The code scanned RAM, found tables of the current process pages, translated the kernel virtual addresses into physical and bypassed Windows’s security mechanisms, including PatchGuard, SMAP and SMEP. The exploit developers used the features of Win32k.sys to redirect individual system calls and run the necessary functions with the rights of the kernel without triggering an immediate system failure.
After adjusting such a mechanism, the attackers had to solve the practical problem, to kill the processes of protective products. The exploit turned to the functions of the PsLookupProcessProcessProcessPrycess, ObDerealenceObject and PsTerminateProcess, found the necessary processes and completed them even with the mechanisms of self-defense. In the version, which Expel studied, the list of targets included Microsoft Defender, ESET, Palo Alto Cortex XDR and SentinelOne. The code ran the cycle over and over again, so the EDR could not restart normally after the process was completed.
Expel separately emphasizes that ktapi.sys refers to old cross-signed drivers. In the new builds of Windows 11 25H2 and Windows Server 2025, Microsoft has disabled automatic trust in such outdated drivers, and a specific ktapi.sys in this mode should be blocked without the administrator’s manual permission. However, researchers warn that the latest version of Windows alone does not close the entire class of BYODVD attacks.
As a protection, Expel recommends that kernel and VBS insulation be included, use vulnerable drivers locking, and configure Windows Defender Application Control. The latter mechanism allows you to build a list of allowed drivers by name, hash, publisher certificate and minimum version, which means reduces the risk of rollback to the old vulnerable component. For older systems, the researchers advise adding ktapi.sys and bound to payload was.exe to detection rules, but not rely only on hash, as attackers may have other versions of the same driver.
The main conclusion from the report is unpleasant for corporate protection. Modern EDR can see malicious actions well in user mode, but the vulnerable driver opens the attacking path to the level, where the protective product itself turns into a normal process under the gun of the kernel. For ransomware, this approach became not exotic, but a working way to prepare the system for encryption in seconds.
