{"id":833,"date":"2026-08-04T15:30:00","date_gmt":"2026-08-04T15:30:00","guid":{"rendered":"https:\/\/cyberasia.io\/article\/threat-intelligence\/earth-longzhi-and-the-byovd-threat-bypassing-windows-kernel-security-in-southeast-asia\/"},"modified":"2026-08-17T08:57:18","modified_gmt":"2026-08-17T08:57:18","slug":"earth-longzhi-and-the-byovd-threat-bypassing-windows-kernel-security-in-southeast-asia","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/threat-intelligence\/earth-longzhi-and-the-byovd-threat-bypassing-windows-kernel-security-in-southeast-asia\/","title":{"rendered":"Earth Longzhi and the BYOVD Threat: Bypassing Windows Kernel Security in Southeast Asia"},"content":{"rendered":"

\u26a0\ufe0f THREAT INTELLIGENCE ADVISORY:<\/strong>
\nThe core foundation of modern operating system security is under direct assault. Earth Longzhi<\/strong>, an aggressive sub-group operating under the umbrella of the prolific China-nexus APT41, has resurfaced in 2026 with highly targeted campaigns across Southeast Asia. Their primary weapon is not a zero-day exploit, but a sophisticated architectural bypass known as BYOVD (Bring Your Own Vulnerable Driver)<\/strong>, allowing them to systematically disable enterprise security software from deep within the Windows Kernel.<\/p>\n

\"Earth<\/p>\n

Recent threat telemetry indicates that Earth Longzhi is heavily targeting the healthcare, government, and manufacturing sectors in Malaysia, the Philippines, Vietnam, and Taiwan. The group\u2019s objective is long-term, stealthy corporate espionage and the exfiltration of sensitive regional data. To achieve this without triggering modern Endpoint Detection and Response (EDR) solutions, they have perfected the art of attacking the operating system\u2019s most privileged ring.<\/p>\n

The Mechanics of a BYOVD Attack<\/h2>\n

Modern operating systems like Windows 11 heavily restrict what software can run at the Kernel level (Ring 0). To load a driver into the Kernel, the driver must possess a valid, cryptographic Digital Signature from a trusted authority (such as Microsoft or a major hardware vendor). This prevents malware from easily establishing deep system persistence or interfering with security software.<\/p>\n

To bypass this, Earth Longzhi utilizes the BYOVD<\/strong> technique. The threat actors do not write their own malicious drivers; doing so would require stealing a digital certificate. Instead, they scour the internet for legitimate, commercially signed drivers<\/em> that have known, unpatched vulnerabilities (such as outdated anti-cheat software, old graphics card drivers, or deprecated antivirus components).<\/p>\n

When Earth Longzhi breaches a target network, they drop this legitimate-but vulnerable-driver onto the compromised endpoint. Because the driver\u2019s digital signature is valid, the Windows OS allows it to load directly into the Kernel. Once loaded, the attackers exploit the known vulnerability within that driver to execute arbitrary code with maximum system privileges.<\/p>\n

Blinding the Defenders<\/h2>\n

Once Earth Longzhi achieves Ring 0 execution via the vulnerable driver, their immediate objective is the systematic neutralization of the victim\u2019s security stack. Operating from the Kernel, the attackers have higher privileges than the EDR or Antivirus software running in the user space (Ring 3).<\/p>\n

They execute \u201cKiller\u201d scripts that forcefully terminate security processes, delete EDR telemetry logs, and block security agents from communicating with their cloud consoles. Because the security software is killed from the Kernel level, the EDR agent is unable to trigger a \u201ctamper protection\u201d alert; it is simply rendered permanently blind. With the defenses dismantled, Earth Longzhi freely deploys custom backdoors, credential dumpers, and lateral movement tools without any fear of detection.<\/p>\n

Earth Longzhi Intelligence Verification<\/h2>\n\n\n\n\n\n\n\n
Tactic \/ Attribute<\/th>\nOperational Details<\/th>\nThreat Severity<\/th>\n<\/tr>\n<\/thead>\n
Attack Vector<\/td>\nBYOVD (Bring Your Own Vulnerable Driver) exploitation at Ring 0.<\/td>\nCritical<\/td>\n<\/tr>\n
Primary Objective<\/td>\nForceful termination and blinding of enterprise EDR\/Antivirus software.<\/td>\nCritical<\/td>\n<\/tr>\n
Target Regions<\/td>\nSoutheast Asia (Malaysia, Philippines, Vietnam, Taiwan).<\/td>\nHigh<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Mitigating the BYOVD Threat<\/h2>\n

Defending against BYOVD attacks requires proactive system hardening, as reactive EDR solutions are explicitly the target of this technique. System administrators must implement Microsoft\u2019s Vulnerable Driver Blocklist<\/strong> and ensure it is strictly enforced via Windows Defender Application Control (WDAC). This blocklist prevents the OS from loading drivers that have been identified as vulnerable, even if their cryptographic signatures are technically valid.<\/p>\n

In addition, maintaining strict Least Privilege access is paramount; loading a driver into the Windows Kernel requires administrative rights. By denying local admin privileges to standard users, organizations can effectively sever the initial stage of the BYOVD attack chain.<\/p>\n

For ongoing technical analysis of APT41, Earth Longzhi, and the evolution of Kernel-level exploits in Asia, continue following our Threat Intelligence reports<\/a>.<\/p>\n

\n
\n
> subscribe_to_intel<\/div>\n

Get CyberAsia threat intelligence updates by email. Unsubscribe anytime. Privacy Policy<\/a>.<\/p>\n<\/div>\n

Mitigation & Prevention Strategies<\/h3>\n

Exploitation of vulnerabilities in critical infrastructure and edge devices requires immediate remediation to prevent catastrophic disruption:<\/p>\n

    \n
  • Patch Management:<\/strong> Apply vendor-supplied security patches or firmware updates immediately. For legacy systems, deploy virtual patching via network firewalls.<\/li>\n
  • Isolate OT Networks:<\/strong> SCADA and OT environments must be strictly isolated from corporate IT networks (the Purdue Model) to prevent spillover attacks.<\/li>\n
  • Continuous Monitoring:<\/strong> Deploy Endpoint Detection and Response (EDR) solutions and monitor network traffic for indicators of compromise (IoCs) associated with known exploits.<\/li>\n<\/ul>\n
    \n","protected":false},"excerpt":{"rendered":"

    \u26a0\ufe0f THREAT INTELLIGENCE ADVISORY: The core foundation of modern operating system security is under direct assault. Earth Longzhi, an aggressive sub-group operating under the umbrella of the prolific China-nexus APT41, has resurfaced in 2026 with highly targeted campaigns across Southeast Asia. Their primary weapon is not a zero-day exploit, but a sophisticated architectural bypass known […]<\/p>\n","protected":false},"author":1,"featured_media":834,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72],"tags":[],"threat_actors":[438],"class_list":["post-833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-intelligence","threat_actor-apt41"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=833"}],"version-history":[{"count":6,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/833\/revisions"}],"predecessor-version":[{"id":3817,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/833\/revisions\/3817"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media\/834"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/categories?post=833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/tags?post=833"},{"taxonomy":"threat_actor","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors?post=833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}