Anderson Leite

**Name of the Vulnerable Software and Affected Versions** ThrottleStop.sys version 3.0.0.0 **Description** The ThrottleStop.sys driver contains an insecure implementation of the `MmMapIoSpace()` function, which exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory. This flaw allows a local user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges (the highest privilege level in the Windows architecture). Consequently, attackers can execute arbitrary code in the kernel context, leading to privilege escalation, bypassing kernel-level protections, and disabling security software. Real-world exploitation has been observed in BYOVD (Bring Your Own Vulnerable Driver) attacks. Malware such as AV Killer and Gentlemen ransomware use this issue to terminate antivirus and EDR processes (including Microsoft Defender, Avast, CrowdStrike, and BitDefender) to facilitate the deployment of ransomware like MedusaLocker. These attacks have been identified targeting organizations in Russia, Belarus, Ukraine, Kazakhstan, and Brazil. Technical details include the use of IOCTL `0x8000649C` to overwrite kernel instructions, such as the `NtAddAtom()` function, with shellcode. The malware may also use the `NtQuerySystemInformation()` function to identify active security processes. **Recommendations** Update ThrottleStop.sys version 3.0.0.0 according to vendor instructions. Disable public RDP access. Implement multi-factor authentication (MFA). Apply strict access controls and network segmentation. Monitor the system for the loading of unusual or unauthorized drivers.