Storm-2603 Leverages Custom Malware and BYOVD to Evade Endpoint Protections

Check Point Research has uncovered sophisticated tactics employed by Storm-2603, a Chinese APT group that leverages legitimate drivers to disable endpoint protection systems while deploying multiple ransomware families simultaneously.

The threat actor, first identified during Microsoft’s investigation into ToolShell SharePoint exploitations, has been actively targeting organizations across Latin America and Asia-Pacific throughout 2025.

Custom “Antivirus Terminator” Weaponizes Legitimate Driver

Storm-2603’s most notable innovation is their “Antivirus Terminator” tool, which exploits the BYOVD (Bring Your Own Vulnerable Driver) technique to neutralize security defenses.

The tool abuses a legitimate, digitally signed driver originally from Antiy Labs’ System In-Depth Analysis Toolkit, renamed from AToolsKrnl64.sys to ServiceMouse.sys.

The malware creates a Windows service called “ServiceMouse” and communicates with the installed driver using specific IO control codes.

The primary function uses control code 0x99000050 to terminate antivirus processes, while additional codes 0x990000D0 and 0x990001D0 enable file deletion and driver uninstallation capabilities.

This approach effectively bypasses traditional endpoint protection by operating at the kernel level with legitimate, signed components that security solutions typically trust.

AK47C2 Framework Enables Persistent Access

According to the report, The threat group employs a custom command-and-control framework dubbed “ak47c2,” featuring both HTTP-based (“ak47http”) and DNS-based (“ak47dns”) communication channels.

The DNS variant uses sophisticated encoding techniques, XOR-encrypting data with the key “VHBD@H” and fragmenting larger payloads into 63-byte segments for DNS TXT record queries to domains like update.updatemicfosoft[.]com.

The HTTP variant follows similar encryption protocols but transmits JSON-formatted commands through POST requests.

Both backdoors execute commands via cmd.exe /c and maintain persistence through randomized session identifiers, making detection and attribution more challenging for security teams.

Multi-Ransomware Deployment Strategy

Storm-2603 distinguishes itself by deploying multiple ransomware families simultaneously, including LockBit Black and Warlock/x2anylock variants.

This multi-strain approach, while uncommon among established groups, increases the likelihood of successful encryption and complicates recovery efforts.

The group leverages DLL hijacking techniques for deployment, using legitimate executables like 7z.exe and clink_x86.exe to side-load malicious libraries.

The attacks also incorporate common open-source tools including masscan for network reconnaissance, PsExec for lateral movement, and nxc for vulnerability exploitation, demonstrating a comprehensive toolkit that combines custom malware with readily available utilities.

This convergence of BYOVD techniques, sophisticated C2 infrastructure, and multi-ransomware deployment represents an evolution in APT tactics that security teams must prepare to counter through enhanced driver validation and behavioral analysis capabilities.

Indicators of Compromise (IOCs)

• updatemicfosoft[.]com
• microsfot[.]org

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates