Over at the bad place, somebody mentioned a "BYOVD" attack that's happening in the wild that's going to be demonstrated at Defcon.
We're not in Las Vegas, because all of that nonsense is silly. So let's look at what we've got.
The Driver is on VirusTotal. It's made by MOCOMSYS & DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the Microsoft recommended driver block rules list, but it's also not in #LOLDrivers anywhere.
The ioctl is 0x2205c0. And you can instruct the Windows kernel to kill a PID that you specify.
Yeah, it works.
Will Dormann
npub1n3…rk88f
2026-08-06 16:57:51 UTC
Author Public Key
npub1n3aew4nfpzqwqmws43pydswj06vu97wch6upnchrz4ku8ckc60nqfrk88fSeen on
wss://relay.ditto.pubPublished at
2026-08-06 16:57:51 UTCEvent JSON
{
"id": "2f6a1e65e6519e6d89f2af606dac08ccf95c711d82e5a50f177bd3f0457787c2",
"pubkey": "9c7b9756690880e06dd0ac4246c1d27e99c2f9d8beb819e2e3156dc3e2d8d3e6",
"created_at": 1786035471,
"kind": 1,
"tags": [
[
"t",
"loldrivers"
],
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/049/607/074/857/318/original/a3a8bd5cc8a2fa7e.mp4",
"m video/mp4",
"dim 800x600",
"blurhash U%I};YRjt7WC~qayWWof?bj[bHofIAayj[ay"
],
[
"proxy",
"https://infosec.exchange/users/wdormann/statuses/117049620645034752",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Over at the bad place, somebody mentioned a \"BYOVD\" attack that's happening in the wild that's going to be demonstrated at Defcon.\n\nWe're not in Las Vegas, because all of that nonsense is silly. So let's look at what we've got.\n\nThe Driver is on VirusTotal. It's made by MOCOMSYS \u0026 DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the Microsoft recommended driver block rules list, but it's also not in #LOLDrivers anywhere.\n\nThe ioctl is 0x2205c0. And you can instruct the Windows kernel to kill a PID that you specify.\n\nYeah, it works.\n\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/117/049/607/074/857/318/original/a3a8bd5cc8a2fa7e.mp4",
"sig": "462fefc2c111f785cc3eacc031e0a8047dc509b7c9006a0443a705a505493592c88abf930b1a6b90ba588fb037b48436ef28412308d2814d5ca1ee9ca95c05bc"
}