Chinese hackers have been spotted using two open-source tools to sign and load malicious kernel mode drivers on compromised endpoints.
According to cybersecurity researchers from Cisco Talos who spotted the campaign, this gives the attackers the highest-possible privilege level. "This is a major threat, as access to the kernel provides complete access to a system, and therefore total compromise,” they said in their analysis.
