When Hackers Bypass Defender: Why “Isolation and Containment” Matters

In early August 2025, cybersecurity firm GuidePoint Security exposed a dangerous new tactic: the Akira ransomware group has been exploiting a legitimate Intel CPU tuning driver—rwdrv.sys, commonly installed by the ThrottleStop utility—to gain kernel-level access and disable Microsoft Defender. Once they have that access, attackers deploy a second malicious driver, hlpdrv.sys, which modifies Windows Registry settings (particularly DisableAntiSpyware) to switch off Defender entirely. This two-stage attack allows ransomware to install and execute undetected. PCWorld Tom's GuideTechRadar

This kind of threat falls under the category of BYOVD (Bring Your Own Vulnerable Driver)—a subtle but powerful technique that abuses legitimate tools to evade traditional security defenses.

Why Traditional “Detect and Respond” Isn't Enough

The ability of Akira to bypass Defender—even actively deployed enterprise-grade endpoint protection—reveals a glaring limitation of the traditional security model:

Detection happens too late. By the time a threat is detected, encryption might already have occurred.
Response may be too slow. Ransomware can disable protection, disable detection tools, or evade them altogether.
Attackers exploit trust. Using signed, trusted drivers allows them to slip past standard checks undetected.

The emergence of AI-driven threats further compounds the problem. For example, cybersecurity researchers at Outflank trained a large language model (Qwen 2.5) using reinforcement learning to generate malware capable of evading Microsoft Defender in about 8% of test cases—a significant leap compared to other models’ sub-1% success rates.

This evolution in attack sophistication underscores a simple truth: detection-based strategies alone can't stay ahead.

Isolation and Containment: A Smarter Defense Strategy

Enter the paradigm shift: Isolation and Containment—a proactive, forward-looking strategy that limits the blast radius of an attack before it can take hold.

AppGuard, with its proven 10-year track record, redefines endpoint protection by isolating unknown or risky processes at the kernel and system level.
Rather than waiting to detect a malicious event, AppGuard contains suspicious behavior instantly—disallowing unauthorized driver loads, registry tampering, or unexpected privilege escalations.
This approach thwarts BYOVD-style attacks like Akira’s by preventing malicious drivers from ever gaining the foothold they need.

Business Implications: Prevention Beats Cure

For business owners, the lesson is clear: investing in endpoint protection that isolates and contains is far more effective than relying on systems that only detect and respond after the fact.

With AppGuard:

You close the window of opportunity for attackers.
You safeguard critical assets even if attackers bypass other layers of defense.
You ensure continuity—without paying ransom or suffering downtime.

Summary Table

Traditional Security (“Detect & Respond”)	AppGuard (“Isolation & Containment”)
Detects threats after execution has begun	Blocks malicious actions preemptively
Reacts post-incident	Prevents escalation and execution altogether
Relies on updating and patching	Uses enforced isolation regardless of patch state
Vulnerable to signed-driver exploits	Neutralizes driver-based bypass techniques

Call to Action

Don’t wait for ransomware to knock at your door. Business leaders, it’s time to elevate your cybersecurity posture beyond detection, embrace isolation and containment. Reach out to us at CHIPS to discover how AppGuard, a proven and battle-hardened endpoint protection solution, can shield your organization from advanced threats like Akira ransomware. Let’s move from “Detect and Respond” to Isolation and Containment and make your defense proactive, not reactive.

Like this article? Please share it with others!