PoisonX Driver-Based Attack Campaign Targets Japanese Organizations

SOC Prime Team

PoisonX Driver-Based Attack Campaign Targets Japanese Organizations

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A campaign observed in April 2026 used spear-phishing emails with malicious LNK files or executable downloads hosted on Google Cloud Storage. The delivered payload installed a kernel driver called PoisonX together with a modular RAT named 10FXRAT, allowing the attackers to gain kernel-level privileges, disable security tools, and conceal malicious activity. Later variants also adopted BYOVD tactics through legitimate signed drivers such as EneIo64.sys and procexp.sys. The activity has been observed targeting organizations in Japan and China.

Investigation

The report walks through the full execution chain, beginning with an LNK-based downloader that invokes curl.exe, then moving to PXDropper components that deploy the PoisonX driver and 10FXRAT modules. It also describes the driver-based IOCTL routines used to terminate security-related processes and hide network traffic. Researchers documented anti-analysis checks, registry modifications, service creation, and persistence methods, and listed hard-coded command-and-control IP addresses associated with the operation.

Mitigation

Defenders should monitor for unexpected driver installation activity, especially drivers that are unsigned or suspiciously signed, and for creation of services with randomized HID-style filenames. Detection should also cover registry changes that add Microsoft Defender exclusions or disable Defender services. Outbound traffic to the identified command-and-control IP ranges should be blocked, and network monitoring should look for the 0x58463031 magic value in TCP payloads.

Response

If this activity is detected, isolate the affected endpoint immediately, unload the PoisonX driver where possible, and terminate all 10FXRAT processes. Restore altered registry settings, re-enable Microsoft Defender protections, and replace modified files with clean versions from trusted sources. A full forensic investigation should then be performed to identify persistence mechanisms and review traffic to the known command-and-control servers.

"graph TB %% Class definitions classDef action fill:#ffcc99 classDef tool fill:#99ff99 classDef malware fill:#ff9966 classDef process fill:#ccccff %% Nodes email["Tool – Name: Phishing Email Description: Targeted email with malicious Google Cloud Storage link"] class email tool initial_access_phishing["Action – T1566.002 Spearphishing Link Attacker sends email containing a link to a malicious LNK or EXE file"] class initial_access_phishing action lNK_file["Tool – Name: Malicious LNK Shortcut Description: Shortcut that runs curl.exe to fetch the dropper"] class lNK_file tool curl_download["Process – Name: curl.exe Action: Downloads PXDropper payload from the remote server"] class curl_download process pxdropper["Malware – Name: PXDropper Description: Dropper that sets up persistence and prepares privilege escalation"] class pxdropper malware persistence_service["Action – T1547.009 Shortcut Modification Creates or modifies a shortcut to achieve autostart"] class persistence_service action registry_run["Action – T1547.001 Registry Run Keys/Startup Folder Adds a Run registry entry for automatic execution"] class registry_run action service_creation["Action – T1543.003 Create or Modify System Process: Windows Service Installs a Windows service to run the dropper at boot"] class service_creation action priv_esc_exploit["Action – T1068 Exploitation for Privilege Escalation Exploits a vulnerability to load a signed driver"] class priv_esc_exploit action driver_install["Malware – Name: PoisonX Driver Description: Signed kernel driver loaded as a service (BYOVD)"] class driver_install malware kernel_privilege["Action – T1547.006 Boot or Logon Autostart Execution Kernel driver grants SYSTEMu2011level privileges"] class kernel_privilege action defense_evasion["Action – T1497.001 Virtualization/Sandbox Evasion Performs checks for analysis environments"] class defense_evasion action rootkit["Action – T1014 Rootkit Hooks kernel APIs to hide processes and network traffic"] class rootkit action discovery_process["Action – T1057 Process Discovery Enumerates running processes on the host"] class discovery_process action discovery_security["Action – T1518.001 Security Software Discovery Detects installed security products"] class discovery_security action defense_impair["Action – Defense Impairment Uses driver IOCTL commands to terminate security product processes"] class defense_impair action c2_ratat["Malware – Name: 10FXRAT Description: Remote access tool that creates an internal SOCKS5 proxy"] class c2_ratat malware c2_communication["Action – T1219 Remote Access Tools Establishes encrypted C2 channel with the attacker"] class c2_communication action proxy_setup["Action – T1090 Proxy Sets up internal SOCKS5 tunnel for traffic forwarding"] class proxy_setup action additional_mods["Action – Additional Capabilities Modular plugins provide keylogging, credential theft, and cryptou2011wallet harvesting"] class additional_mods action %% Connections showing the attack flow email –>|delivers| initial_access_phishing initial_access_phishing –>|provides| lNK_file lNK_file –>|executes| curl_download curl_download –>|downloads| pxdropper pxdropper –>|creates| persistence_service persistence_service –>|registers| service_creation service_creation –>|runs| pxdropper pxdropper –>|adds| registry_run pxdropper –>|uses| priv_esc_exploit priv_esc_exploit –>|installs| driver_install driver_install –>|grants| kernel_privilege kernel_privilege –>|enables| rootkit rootkit –>|performs| defense_evasion rootkit –>|performs| discovery_process rootkit –>|performs| discovery_security discovery_process –>|enables| defense_impair pxdropper –>|drops| c2_ratat c2_ratat –>|uses| c2_communication c2_communication –>|establishes| proxy_setup proxy_setup –>|supports| additional_mods "

PoisonX Driver-Based Attack Campaign Targets Japanese Organizations

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Suspicious CURL Usage (via cmdline)

Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)

Disabling Windows Defender Protections (via registry_event)

Possible Malicious LNK File with Double Extension (via cmdline)

The Possibility of Execution Through Hidden PowerShell Command Lines (via cmdline)

Call Suspicious .NET Classes/Methods from Powershell CommandLine (via process_creation)

System Processes Execution from Untypical Paths (via process_creation)

Call Suspicious .NET Methods from Powershell (via powershell)

Windows Defender Preferences Suspicious Changes (via powershell)

Google Api Storage Domain Was Resolved By Unusual Process (via dns_query)

IOCs (HashSha256) to detect: PoisonX Driver-Based Attack Campaign Targeting Japanese Organizations Part 2

IOCs (HashSha256) to detect: PoisonX Driver-Based Attack Campaign Targeting Japanese Organizations Part 1

IOCs (SourceIP) to detect: PoisonX Driver-Based Attack Campaign Targeting Japanese Organizations

IOCs (DestinationIP) to detect: PoisonX Driver-Based Attack Campaign Targeting Japanese Organizations

Detection of 10FXRAT C2 Communication [Windows Network Connection]

Detection of 10FXRAT and Security Service Disabling Commands [Windows Process Creation]

Malware Persistence via Windows Defender and Run Key Modifications [Windows Registry Event]

Simulation Execution