POORTRYMalware
According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.From MISP Galaxy
Last reported 15 months ago, by Group-IB2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1553.002Code Signing
“Figure 3: Code Signing Capability Overlaps Identified Among Different Threat Actors”
- T1055.004Asynchronous Procedure Call
“To terminate the thread, the malware queues an APC (asynchronous procedure call) to execute code in the context of the targeted thread.”
- T1110Brute Force
“For each process, it iterates over their handles, also using brute force, and checks if the underlying object corresponds to the client process.”
- T1222File and Directory Permissions Modification
“File and Directory Permissions Modification”
- T1684Social Engineering
“"Attackers Leveraging Microsoft Teams Defaults and Quick Assist for Social Engineering Attacks", January 31 2025.”
- T1685Disable or Modify Tools
“Disable or Modify Tools”
What the reports say
2 reports, newest first · the exact sentence from each-
Exploiting Trust: How Signed Drivers Fuel Modern Kernel Level Attacks on Windows“POORTRY was used by Cuba, Hive, and LockBit ransomware.”
-
Shedding light on the ABYSSWORKER driver“In 2022, Google Cloud Mandiant disclosed a malicious driver called POORTRY which we believe is the earliest mention of this driver.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Rootkit_AbyssWorker.yarin 1 report
- 6a2a0f9c56ee9bf7…8cc5b1e8d050in 1 report
- b7703a59c39a0d2f…7551b8eed505in 1 report
- hxxps://github[.]com/wavestone-cdt/EDRSandblast/tree/masterin 1 report
- hxxps://github[.]com/myzxcg/RealBlindingEDRin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.