BADIIS Malware Masquerading as Driver File

Tim Peck@timpeck

•updated Feb 16, 2026•1•0•49

Detects the creation of files with a .sys extension in the C:\Windows\System32\drivers\ directory that are actually portable executables (DLLs/EXEs). This is a staging technique used by the REF4033 group to deploy the BADIIS malware.