Hacker Discovers Way to Remotely Disable Windows Defender, How to Avoid It?

 Hacker Discovers Way to Remotely Disable Windows Defender, How to Avoid It?

Hackers have discovered a new way to remotely disable Microsoft Windows Defender. Fox News has reported that the Akira ransomware group has launched undetected attacks by completely disabling Microsoft Defender using a legitimate Intel CPU tuning driver.

Microsoft Defender serves as the first line of defense against malware on modern Windows PCs. However, a hacker group has found a way to completely disable Microsoft Defender by abusing a legitimate Intel CPU tuning driver in a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.

This method of attack has been seen in active ransomware attacks since mid-July 2025. It works without exploiting any software bug or delivering an explicitly malicious file. They take advantage of how the Windows driver system is designed to gain access to the inside of the hardware.

The Akira ransomware group exploits a legitimate Intel CPU tuning driver called ‘rwdrv.sys’ through a performance-tweaking tool called ThrottleStop. According to cybersecurity firm Guidepoint Security, attackers load this driver to gain kernel-level access to Windows systems. They then install another malicious driver called ‘hlpdrv.sys’.

Which disables Microsoft Defender by changing the ‘DisableAntiSpyware’ registry setting via ‘regedit.exe’. Once Defender is disabled, attackers can run other malicious programs undetected. Akira often carries out attacks with the aim of stealing data, secretly establishing remote access, and using ransomware to encrypt an organization’s files.

How to avoid the attack?

While this attack on Microsoft Defender is dangerous, you can protect yourself if you take precautions. Use strong antivirus software for this. Strong antivirus software with regular updates for Windows systems can provide real-time protection, kernel-level monitoring. This helps protect your personal information and digital assets from malicious links, phishing emails, and ransomware.

Such cyber attacks rely on user interaction. So, do not click on suspicious links. Also avoid actions such as downloading files from them or mounting untrusted virtual disks. Use only trusted websites and use built-in security features in browsers such as Microsoft Edge or Chrome with Safe Browsing enabled.

Also, never paste or run commands, such as PowerShell scripts, that you do not understand or that are copied from random websites. Attackers often trick users into running malware unknowingly in this way.

Regularly update all software applications, including your operating system and browser. Updates often include patches for security vulnerabilities.

Enable two-factor authentication on all your accounts. This makes it difficult for attackers to gain access to your account even if they know your password.