The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In December 2022, security researchers reported malicious Windows drivers bearing signatures issued through Microsoft’s Windows Hardware Developer Program. Attackers used the drivers in post-compromise activity to interfere with endpoint security processes; separate reporting also linked driver abuse to ransomware activity. A valid signature showed that a driver passed through a signing process—it did not prove the driver was safe.
What security firms reported
On December 13, 2022, Microsoft published advisory ADV220005 after researchers reported that drivers certified through its Windows Hardware Developer Program were being used in attacks. The reported activity included attempts to disable or interfere with security tools after attackers had gained access, as well as ransomware-related activity. The cases involved different actors and operations, not one unified campaign.
In a December 14, 2022 report, SecurityWeek quoted Microsoft as saying: “Microsoft has completed its investigation and determined that the activity was limited to the abuse of several developer program accounts and that no compromise has been identified. We’ve suspended the partners’ seller accounts and implemented blocking detections to help protect customers from this threat,” Microsoft said.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How a signed driver could be used against security software
Signing establishes a chain of provenance, not benign intent
Windows applies signing requirements to modern kernel drivers, and Microsoft’s Windows Hardware Developer Center Dashboard participates in the signing process. Mandiant described an attestation workflow involving developer-program registration, an Extended Validation certificate, submission of a signed package, and a Microsoft signature. In the cases analyzed, researchers found malicious drivers with Microsoft Windows Hardware Compatibility Publisher signatures.
#1 Best Overall
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
A signature can help identify the signing chain and submitting organization, but it is not a guarantee that code is harmless. The incident was described as abuse of developer-program accounts and signing processes—not as Microsoft knowingly approving malware. SentinelOne and Mandiant both explain how signed drivers can enter an environment where the operating system and security products treat signed code differently from unsigned code.
STONESTOP and POORTRY had different roles
SentinelOne analyzed a small toolkit with two components. STONESTOP was a Windows userland loader and orchestrator; POORTRY was the kernel-mode driver it directed. In analyzed variants, SentinelOne documented the ability to terminate, suspend, and resume selected processes, and described later file-tampering capabilities. Mandiant separately characterized POORTRY as a driver whose process-termination behavior required a userland utility to initiate it.
At a high level, the toolkit let an operator use a driver to interfere with selected processes, including endpoint security software. The driver was one part of post-compromise activity, rather than a standalone explanation for how attackers initially entered a network.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- Watchguard Tech WG50021 Firebox X20e-Wireless
Who was linked to the activity, and what was targeted?
The firms described multiple operations with overlapping tooling. Their reporting should be read as separate observations, not proof that every named actor, victim, or objective belonged to the same campaign.
| Reporting source | What it reported |
|---|---|
| Mandiant, December 2022 | Financially motivated group UNC3944 used STONESTOP and POORTRY as early as August 2022. Mandiant said the group commonly obtained network access using credentials acquired through SMS phishing and connected some post-compromise objectives to credentials or systems that could enable SIM-swapping operations. |
| SentinelOne, 2022 investigations | Observed activity affecting organizations in business process outsourcing, telecommunications, managed security services, finance, cryptocurrency, entertainment, and transportation. In some cases, SentinelOne said the objective supported SIM-swapping services; it separately observed a similar driver in a Hive ransomware attack against a medical organization. |
| SecurityWeek’s December 14, 2022 summary of Sophos research | Connected the Cuba ransomware operation with BurntCigar, a tool used to disable endpoint protection. This point is attributed here to SecurityWeek’s summary. |
Mandiant counted at least nine unique organization names associated with attestation-signed malware in its investigation. That is an investigation-specific count of names, not nine confirmed victim organizations and not an estimate of how often malicious signed drivers occur. Mandiant also identified eleven suspicious files when pivoting on a signature metadata field; that, too, is a research finding rather than a population-wide prevalence measure.
What Microsoft said it did
As reported by SecurityWeek on December 14, 2022, Microsoft said it suspended the implicated developer-program seller accounts, implemented blocking detections, and released Windows updates revoking abused certificates. Those statements describe Microsoft’s response at the time of the disclosure; they do not establish the current status of every certificate, Windows release, or driver blocklist entry.
Rank #3
- XGS 88 with 3 Years Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- Equipped with 4 x 2.5 GE copper ports, supporting up to 9.9 Gbps firewall performance for small offices and branch deployments.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
For present-day administration, consult Microsoft’s current guidance for advisory ADV220005 and check the applicable driver blocklist and update guidance for the Windows versions and devices in your environment. The 2022 reports alone do not establish which current controls are enabled or applicable on a particular system.
Recommended Free Tools
What the incident does—and does not—show
- It shows that abuse of developer-program accounts and signing workflows can put malicious drivers into post-compromise operations.
- It shows why a valid signature should be treated as provenance information, not a safety verdict.
- It does not establish a representative rate for malicious signed drivers or the prevalence of this technique across Windows systems.
- It does not mean that Microsoft intentionally signed malware, or that the distinct actors and cases reported by the firms were one campaign.
Practical implications for defenders
For organizations, the incident is a reminder to evaluate drivers by more than the presence of a signature. Useful defensive questions include whether monitoring can surface unusual driver provenance or signing metadata, whether controls can detect or block suspicious driver behavior, how quickly vendor detections and certificate revocations reach endpoints, and whether the relevant protections support the organization’s Windows versions and operating environment. These are evaluation questions, not a claim that any specific product was tested or that a single control removes the risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
