- Microsoft Patches Paragon Partition Manager, after finding five deficiencies in a core level driver
- One of the deficiencies was actively used to drop ransomware
- The driver may be abused even without the partition manager installed
Hackers use a vulnerable Windows driver to escalate privileges through Microsoft software, providing possible ransomware attacks via zero days.
Microsoft confirmed the conclusions when it added the affected version of the driver to its vulnerable driver block list – and at the same time, the five deficiencies patched in the defective software and encouraged users to use updates as soon as possible.
The shortcomings were apparently found in Biontdrv.sys, a core level driver to a piece of software called Paragon Partition Manager. Cyber criminals who have already managed to gain some access to a target point would either use this driver (if the software is installed on the device) or let go of it to get system rights in Windows used to mount ransomware attacks.
Control of the Blocklist
“An attacker with local access to a device can utilize these vulnerabilities to escalate privileges or cause a rejection-of-service scenario (DOS) on the victim’s machine,” Cert/CC said. “As the attack involves a Microsoft-signed driver, an attacker can also take advantage of a bring your own vulnerable driver (Byovd) technique to utilize systems even if the Paragon Partition Manager is not installed.”
Microsoft said that four of the deficiencies affected Paragon Partition Manager versions 7.9.1 and the elderly, where the fifth (CVE-2025-0298) affects version 17 and the elderly were also the one who was apparently actively exploited in ransomware attacks.
Now users are encouraged to upgrade the software to the latest version as it also comes with Biontdrv.sys version 2.0.0.
In addition to upgrading the software, users also need double control if the blocklist is enabled, by going to settings – privacy and security – Windows Security – Device Security – Core Isolation – Microsoft Vulnerable Driver Blocklist and make sure it’s turned on.
Via Bleeping computer
