throttlestop.sys

ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms. Akira ransomware affiliates have dropped this same signed driver (same SHA256) as rwdrv.sys in %TEMP% and registered it as a kernel service named mgdsrv, alongside the malicious hlpdrv.sys (service KMHLPSVC), to disable Microsoft Defender. Note that the rwdrv.sys filename collides with the unrelated RWEverything RwDrv.sys driver, so name-based hunting will conflate the two; hunt on hash or the TechPowerUp LLC signer instead. Per the public CVE-2025-7771 PoC write-up, the driver derives its device name from the service name, so device-name based detections are also unreliable. IronChain ransomware also bundles this driver and configures IOCTL 0x8000649C, but per ANY.RUN's static analysis never sends it.

sc.exe create throttlestop.sys binPath= C:\windows\temp\throttlestop.sys type=kernel && sc.exe start throttlestop.sys