burntcigar.sys

burntcigar.sys is a malicious kernel driver designed to terminate endpoint protection processes before criminal threat actors deploy their payload. First observed in November 2021, it has been documented by Sophos, Mandiant, and Fortinet as a defense-evasion tool used by the Cuba (UNC2596) criminal group, among others. BlackCat, LockBit, and other data-extortion operators have also been documented using it.

BurntCigar targets over 200 security processes by name. Early variants were signed with stolen NVIDIA certificates; later versions abused Microsoft's WHQL attestation signing before Microsoft deactivated the fraudulent accounts. Sophos documented a further evolution in which the driver moved beyond process termination to actively wiping endpoint protection files from disk.

The tool uses a user-mode loader (sometimes called Stonestop) to install and start the driver. It is on the public LOLDrivers list.

Not a legitimate vendor driver. Its presence has no innocent explanation. If found, escalate to incident response.

burntcigar.sys is listed as malicious on the public LOLDrivers project. One distinct binary hash matching this filename is on record.