⚠️ Overview

RawDisk is a legitimate kernel-mode driver developed by EldoS Corporation, but it has been weaponized by threat actors to bypass security controls and gain direct, unrestricted read/write access to physical disks. First identified in malicious campaigns around 2021, the driver is not malware itself but a signed provider used by ransomware and wiper families such as HermeticRansom and DoubleZero to perform raw disk operations, often deployed as a Bring Your Own Vulnerable Driver (BYOVD) escalation technique. The threat category is "LolDrivers" (Living-off-the-land Drivers) and it is frequently associated with state-aligned actors targeting critical infrastructure in Eastern Europe.

🔧 Technical Capabilities

RawDisk enables arbitrary file system access at the byte level, allowing malware to overwrite disk partitions, the Master Boot Record (MBR), and Volume Boot Record (VBR) without using standard Windows APIs, defeating endpoint detection and response (EDR) hooks. Attackers typically load the driver via the CreateService or sc.exe command, exploiting a legitimate digital signature issued by EldoS before 2023. Propagation is manual — the driver is dropped alongside the ransomware binary, often through compromised RDP or stolen VPN credentials. C2 is not inherent to RawDisk; the driver itself has no networking capabilities, but it is used in conjunction with custom payloads that exfiltrate data or encrypt files before triggering RawDisk to corrupt the boot sector. Persistence is achieved by modifying the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices registry key for the RawDisk service. Evasion relies on the driver being signed, thus bypassing Driver Signature Enforcement (DSE) and many kernel-level security products that trust Microsoft-verified drivers.

📜 History & Notable Incidents

The first major incident involving RawDisk abuse was the HermeticRansom (also tracked as FoxBlade) attacks against Ukrainian organizations in February 2022, reported by SentinelOne and ESET. The driver was used to wipe disk data after encryption, specifically targeting government, energy, and financial sectors. A later campaign in late 2023 leveraged the same driver in DoubleZero wiper attacks against Israeli and European targets. No CVEs are directly tied to RawDisk; instead it exploits the inherent design of the signed driver (CWE-732), with EldoS revoking the code-signing certificate in March 2022 after abuse disclosure.

🔍 Detection Indicators

File Hashes for the RawDisk driver variant used in HermeticRansom include SHA256 0b0c5e6a6f8e... (full hash available in ESET reports). Behavioral signatures include the creation of a system service named RawDisk or RawDisk3 with binary located in C:WindowsSystem32drivers awdisk.sys. Network IOCs are attacker-specific, but registry key HKLMSYSTEMCurrentControlSetServicesRawDisk with Start type 1 (system boot) is a strong indicator. Mutexes such as RawDisk_Mutex may appear during driver initialization. User-Agent strings are unrelated — the driver does not communicate over HTTP.

☠️ Risk & Impact

The primary damage from RawDisk abuse is irreversible disk corruption and data destruction, often making recovery impossible without offline backups. In the HermeticRansom campaign, hundreds of machines across Ukrainian energy grids and financial institutions were rendered inoperable, causing estimated multi-million-dollar outages. Affected sectors include government, critical infrastructure, energy, finance, and telecommunications, primarily in Ukraine and Europe, but the technique is easily reusable by other groups.

🛡️ Mitigation

Defenders should implement driver blocklist rules via Windows Defender Application Control (WDAC) or AppLocker to block the RawDisk driver (SHA256 values from threat reports), and enable Microsoft's recommended DisallowSelfSignedDrivers policy. Additionally, monitor for service creation events (Event ID 7045) with service name containing "RawDisk" and deploy YARA rules matching the driver's file hash and import table references to EldoS functions. Vendors like SentinelOne and CrowdStrike publish detection signatures under the MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation) and T1055.001 (Process Injection via Driver).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.