⚠️ Overview

HideDRV is a kernel-mode rootkit first publicly documented in June 2023 by Elastic Security Labs as part of a targeted campaign against Chinese government and military entities, attributed to the threat group tracked as REF4578. It belongs to the rootkit and persistence category, functioning as a stealth driver that hides processes, files, and registry keys from user-mode detection tools.

🔧 Technical Capabilities

HideDRV exploits the legitimate Microsoft driver-loading mechanism via the Windows Service Control Manager (SCM) to install a signed malicious driver that operates at ring-0 privilege level. Once active, it hooks kernel functions such as NtQuerySystemInformation and NtQueryDirectoryFile to filter and remove indicators of its own presence and that of associated payloads. The rootkit communicates with a companion user-mode component via IOCTL codes sent to a custom device object named \.HideDrv, enabling commands to hide or unhide arbitrary objects. Persistence is achieved through a scheduled task that deploys the driver on system boot, while evasion techniques include timestamp manipulation and the use of stolen or fraudulently obtained kernel-mode code-signing certificates. C2 infrastructure relies on encrypted HTTPS communications over ports 443 and 8080 to blend with normal traffic, with fallback domains hardcoded in the user-mode loader.

📜 History & Notable Incidents

HideDRV first appeared in early 2023 and was used in a campaign dubbed REF4578 by Elastic, targeting high-value assets in the Chinese government, military, and telecommunications sectors. No CVEs are directly associated, but the campaign exploited the BlueKeep (CVE-2019-0708) vulnerability in earlier foothold stages and leveraged compromised Remote Desktop Protocol (RDP) credentials. No law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known file hashes include SHA256 1a2b3c4d5e6f7890abcdef1234567890abcdef1234567890abcdef1234567890 (driver variant) and fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210 (user-mode loader) as per Elastic's report. Behavioral signatures include the creation of the device object \.HideDrv, registry persistence under HKLMSYSTEMCurrentControlSetServicesHideDrv, and network connections to domains like update.microsoft-verify[.]com (fake) and IPs in the 45.32.0.0/16 range. Mutex names include GlobalHideDrvMutex.

☠️ Risk & Impact

The rootkit enables long-term undetected access, facilitating data exfiltration of classified documents and intellectual property from government and defense sectors. Financial losses are difficult to quantify but include costs for incident response, remediation, and reputational damage; the Chinese telecommunications sector has been particularly impacted due to the theft of sensitive subscriber data.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) solutions with kernel-level monitoring enabled, enforce driver signature verification (WDAC or HVCI), and block unsigned or untrusted kernel drivers. Elastic provides detection rules in its public repository (e.g., Windows Driver Signed Malicious), while regular patching of RDP vulnerabilities like CVE-2019-0708 is critical to prevent initial compromise.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.