Executive Summary
In August 2026, a campaign delivering the ACRStealer (rebranded as Amatera Stealer) infostealer was identified using a Bring Your Own Vulnerable Driver (BYOVD) technique to potentially disable EDR and security products. The infection starts with a Microsoft IExpress self-extractor (setup_patched.exe) that deploys an encrypted AutoIt payload. This payload targets browser credentials, cookies, and cryptocurrency wallets while communicating with a C2 via a Telegram-based Dead Drop Resolver (DDR).
The most critical technical finding is the deployment of DCRCVDrv.sys, a legitimate Microsoft-signed kernel driver from Korean vendor MOCOMSYS & DCRC. Static analysis confirms the driver contains an ungated IOCTL (0x2205c0) that allows any process to terminate arbitrary PIDs from kernel context. This bypasses user-mode tamper protection. While the full 140+ vendor kill-list was not recovered, the driver provides the functional primitive required for effective EDR suppression.
This case highlights the growing trend of adversaries weaponizing legitimate, signed enterprise security software rather than developing custom rootkits. Organizations should be aware that the driver is currently not on the Microsoft vulnerable-driver block list and may blend into environments where Korean enterprise security software is standard.