# Shedding light on the ABYSSWORKER driver

ABYSSWORKER is a signed malicious Windows kernel driver deployed with MEDUSA ransomware that strips EDR handles, callbacks, hooks and kills security processes via IOCTLs.

- Payout: Real-world hack
- Program: MEDUSA ransomware
- Credited: Cyril François
- Disclosed: 2025-03-20
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/abyssworker
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker
- Tags: domain:desktop impact:integrity impact:privesc kind:incident platform:threat-intel tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows kernel driver (smuol.sys) impersonating CrowdStrike Falcon driver
**Root cause:** A revoked-certificate-signed kernel driver exposes IOCTLs gated by a hardcoded password that let a client strip process handles, unregister notification callbacks, replace driver major functions, detach FltMgr devices, kill system threads and restore NTFS/PNP hooks, blinding EDR from kernel mode.
**Steps:**
1. Obtain sample smuol.sys (SHA256 6a2a0f9c...d050) and open device `\device\czx9umpTReqbOOKF` via symbolic link `\??\fqg0Et4KlNt4s1JT`
2. Send IOCTL `0x222080` with password `7N6bCAoECbItsUR5-h4Rp2nkQxybfKb0F-wgbJGHGh20pWUuN1-ZxfXdiOYps6HTp0X` to set enable flag
3. Send IOCTL `0x2220c0` with `struct_433_t` mapping of 25 function names to RVAs (e.g. PspLoadImageNotifyRoutine=0xcec620) to resolve kernel APIs
4. Use `0x222400` with target module name to unregister Ps*/Ob*/Cm* callbacks and remove devices
5. Use `0x222404` to overwrite target driver major functions with IopInvalidDeviceRequest
6. Use `0x222440` to detach FltMgr.sys mini-filter devices; `0x222408` to APC-kill target module system threads
7. Use `0x222444` to restore hooked NTFS/PNP major functions; `0x222144`/`0x222140` to terminate processes/threads
**How found:** Elastic Security Labs monitored a MEDUSA campaign using a HEARTCRYPT loader and a revoked-certificate-signed driver; they reverse-engineered the driver, identified constant-returning obfuscation functions, mapped the device/symbolic link and IOCTL dispatch table, and cross-referenced with ConnectWise and Mandiant POORTRY reporting.
**Exploitation:** HEARTCRYPT-packed loader drops the signed driver alongside MEDUSA ransomware, installs it, opens the device, authenticates with the hardcoded password, loads kernel API pointers, then issues IOCTLs to strip handles to the ransomware process, unregister EDR notification callbacks, replace EDR driver dispatch routines, detach mini-filter devices and kill EDR system threads, disabling anti-malware before encryption.
**Escalation:** Driver also protects its client process by stripping existing handles from all running processes and registering ObRegisterCallbacks that zero out requested access to the protected PID and its threads.
**Insight:** Malicious drivers gate destructive IOCTLs behind a hardcoded password and a user-supplied name-to-RVA API map so they can resolve undocumented kernel symbols without imports; defenders can hunt for drivers creating randomly-named devices and for IOCTL handlers that brute-force PIDs/TIDs and call ObUnRegisterCallbacks or overwrite MajorFunction pointers.