The ALPHV (aka BlackCat) ransomware has been observed in February 2023 with a new capability that correlates with activity detailed in three (3) reports published in late 2022. The three (3) reports detailed “malicious kernel drivers being signed through signed Microsoft hardware developer accounts,” which were seen in various cyberattacks involving ransomware-based incidents. Researchers noted the capability, which is a malware dubbed “POORTRY”, was used in the recent activity for the defense evasion phase of the attack and was an updated version that “inherited the main functionality from the samples disclosed in previous research,” as the threat actor initially attempted to deploy a kernel driver identified in December 2022. The updated POORTRY malware can conduct the following actions: activating and deactivating the driver, killing any user-mode processes, deleting specific file paths, copying files, force-deleting files, force-copying files, registering and unregistering process and thread notification callbacks, and rebooting the system. It is explained that the commands for the process and thread notification callbacks are currently in development and not working as of May 22, 2023. The malicious driver has been used previously by UNC3944 (aka oktapus and Scatter Spider) in order to bypass detection, so there is suspicion of a loose linkage between the two (2) threat groups. Researchers emphasized that ALPHV affiliates have “a high level of interest in gaining privileged-level access for the ransomware payloads they use in their attacks” and that kernel-based threats are most commonly observed in advanced persistent threat (APT) espionage malware and ransomware. CTIX analysts will continue to monitor ALPHV’s activity and advancements as it evolves. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.