Qilin Found a Way to Blind Your EDR Before You Know They're Inside

Talos researchers Takahiro Takeda and Holger Unterbrink published a detailed technical teardown of the infection chain. Here is what the kill sequence actually looks like inside your environment:

The core problem is architectural. Windows enforces a protection boundary between user-space (Ring 3) and kernel-space (Ring 0). Your EDR lives in user-space. To have visibility at the kernel level, it registers callbacks with the OS, hooks that notify it when processes launch, memory is written, or drivers load.

BYOVD attacks this model at its foundation. By loading a legitimate, digitally signed driver, the attacker obtains kernel-level access through a channel that Windows explicitly trusts. From that position, they can reach directly into the kernel callback table and remove the registrations your EDR depends on. By the time your security tool would normally generate an alert, its entire notification infrastructure has been surgically removed.

What makes the Qilin implementation particularly concerning is the depth of the evasion layering. The loader neutralizes user-mode hooks before the driver is even introduced, suppresses telemetry through exception-handler manipulation, and keeps the most sensitive payload components encrypted in memory until the moment of execution.

BYOVD has been a known technique for years. What has changed is its operational status. It is no longer a niche capability reserved for nation-state actors or red teams. The same vulnerable drivers abused in the Qilin chain, rwdrv.sys and hlpdrv.sys, have also appeared in Akira and Makop ransomware intrusions.

Warlock has its own BYOVD implementation documented by Trend Micro. In December 2025, Cisco Talos documented a DeadLock ransomware campaign using a BYOVD loader against a vulnerable Baidu Antivirus driver to terminate EDR processes and disable Windows Defender entirely.

The pattern is unmistakable: the criminal ransomware ecosystem has converged on EDR elimination as a standardized pre-encryption phase. These are not boutique capabilities. They are operationalized, reusable components being applied at scale across the entire ransomware-as-a-service economy.

Qilin, also tracked as Agenda, Gold Feather, and Water Galura, operates as a ransomware-as-a-service platform. That means BYOVD capability is now available to any affiliate who rents access, no specialized kernel engineering required.

In a normal Qilin intrusion, attackers rely on stolen credentials for initial access and often delay ransomware deployment by days. Under standard circumstances, that dwell time is an opportunity, a window during which a properly staffed security team might detect post-compromise activity and contain the intrusion before encryption begins.

BYOVD directly destroys that opportunity. By targeting the EDR tooling and kernel callbacks a SOC team depends on for visibility, attackers can extend their operational window while simultaneously eliminating the defender's ability to capitalize on it. When encryption finally starts, the security stack has already been dark for some time.

For CISOs and security architects, the implication is direct: EDR is no longer sufficient as a primary ransomware defense layer. Any architecture that relies on EDR as the last line of defense has a gap that Qilin already knows about and is actively exploiting.

The following indicators have been confirmed by Cisco Talos across observed Qilin intrusions. Any instance of the malicious DLL outside its legitimate system path warrants immediate host isolation.

Immediate remediation steps for your security team: