FudModule is a sophisticated kernel-manipulation tool that doesn't steal your data or encrypt your files—it tears down the fences that protect you from other malware. This user-mode DLL weaponizes the "Bring Your Own Vulnerable Driver" (BYOVD) technique to gain unauthorized write access to Windows kernel memory, allowing it to turn off critical system monitoring features across the board. Once active, FudModule can blind your antivirus, disable EDR agents, and cripple firewall protections, leaving your machine wide open to follow-on attacks. If you've encountered this threat, you're likely dealing with a targeted intrusion or a secondary infection following ransomware deployment.
Threat Profile
| Threat Name | FudModule (also known as LIGHTSHOW) |
|---|---|
| First Documented | Before September 2026 (Malpedia updated 2026-09-24) |
| Threat Category | Rootkit / Security Evasion Tool / BYOVD Exploit |
| Platforms Affected | Windows (all modern versions capable of driver loading) |
| File Type | Windows PE DLL (user-mode, but kernel-targeting) |
| Typical File Size | Varies by build |
| Primary Goal | Disable Windows security monitoring and kernel callbacks |
| Payload Behavior | Kernel memory manipulation; disables EDR, antivirus callbacks, firewalls, and forensic hooks |
| Common Aliases (AV Engines) | FudModule, LIGHTSHOW |
| Distribution Method | Deployed by attackers post-compromise; often bundled with ransomware or advanced persistent threat (APT) toolkits |
| Severity Level | Critical — undermines all endpoint security defenses |
| Removal Difficulty | High — requires offline analysis and kernel integrity restoration |
How It Spreads
FudModule is not a worm or a self-replicating virus. It's a precision tool deployed by human attackers who have already gained administrative access to a target system. Typically, FudModule arrives during the later stages of a cyberattack—after initial compromise but before the main payload (such as ransomware) is executed. The attackers use it to blind your defenses so their next moves go undetected.
This malware relies on the BYOVD (Bring Your Own Vulnerable Driver) technique, which means the attacker drops a legitimate but outdated or intentionally vulnerable signed driver onto your system, then exploits it to gain kernel-level read/write privileges. Because the driver is legitimately signed, Windows may load it without complaint, even on systems with driver signature enforcement enabled. Once that bridge is built, FudModule crosses into kernel space and begins its sabotage.
Common distribution chains for FudModule include:
- Ransomware pre-deployment: Attackers install FudModule just before deploying ransomware to prevent EDR tools from blocking the encryption process.
- APT (Advanced Persistent Threat) toolkits: Nation-state or sophisticated criminal groups use FudModule to maintain stealth during long-term network intrusions.
- Post-exploitation frameworks: Tools like Cobalt Strike or Metasploit payloads may drop FudModule to disable endpoint defenses after gaining a foothold.
- Manual installation by intruders: Once an attacker has Remote Desktop Protocol (RDP) or administrative access, they can manually install FudModule to prepare the system for further exploitation.
- Software supply chain attacks: In rare cases, FudModule components have been bundled into trojanized installer packages or cracked software.
What It Does On Your Machine
FudModule's mission is singular and devastating: disable every kernel-level hook, callback, and monitoring mechanism that security software relies on. It doesn't steal files or mine cryptocurrency—it makes your computer deaf and blind to threats. Once FudModule completes its work, your antivirus may still appear to be running, but it can't see malicious activity. EDR agents stop reporting. Firewalls lose the ability to inspect traffic. Even forensic tools used by incident responders may fail to detect artifacts.
The malware operates in user mode but manipulates kernel memory by exploiting the vulnerable driver it brings along. It targets kernel variables and callback registrations used by Windows and third-party security products. Specifically, FudModule removes or nullifies callbacks that monitor process creation, image loading, registry modifications, and network events. Without these callbacks, security tools lose their eyes and ears. The malware also manipulates kernel structures that control minifilter drivers (used by antivirus and forensic tools) and may disable Event Tracing for Windows (ETW), which logs security-critical events.
From a user's perspective, the system may appear to function normally. There are no ransom notes, no desktop hijacking, no obvious signs of infection. But under the hood, the machine is defenseless. Any subsequent malware—ransomware, data exfiltration tools, backdoors—can operate without interference. In some observed incidents, FudModule has been deployed alongside legitimate-looking administrative tools, disguising its presence among dozens of system DLLs and drivers.
The vulnerable driver is the linchpin. Without it, FudModule cannot escalate to kernel-level manipulation. Attackers have been observed using legitimate but outdated drivers from trusted vendors—Process Explorer (procexp.sys), MSI Afterburner (rtcore64.sys), and others with known read/write primitives. These drivers were never intended for malicious use, but their vulnerabilities allow arbitrary kernel memory access when exploited. Once FudModule gains this access, it hunts for and neutralizes callback structures across the kernel, effectively turning off security monitoring at the source.
Manual Removal — Step by Step
Disconnect from all networks immediately
Unplug Ethernet cables and disable Wi-Fi. FudModule is often deployed alongside other threats, and staying connected allows attackers to monitor your removal attempts or deploy additional malware. Work offline until the system is confirmed clean.
Boot into Safe Mode or use a clean environment
Restart your PC and boot into Safe Mode with Networking (press F8 or Shift+Restart, then select Troubleshoot > Advanced Options > Startup Settings > Safe Mode). Alternatively, boot from a trusted Linux USB drive to inspect the Windows partition offline. FudModule relies on the vulnerable driver being loaded, and Safe Mode may prevent it from initializing.
Identify and remove the vulnerable driver
Navigate to C:\Windows\System32\drivers\ and look for recently added or out-of-place .sys files. Common culprits include procexp.sys, rtcore64.sys, capcom.sys, and similar. Right-click, check the file's Properties and Digital Signature tab. If it's dated several years old or signed by a vendor that shouldn't be in your drivers folder, delete it. You may need to take ownership of the file first (right-click > Properties > Security > Advanced > Owner).
Locate and delete the FudModule DLL and loader
Check C:\Windows\Temp\, C:\ProgramData\, C:\Users\Public\, and C:\ProgramData\Microsoft\Windows\ for suspicious DLLs or executables with generic names like fud_module.dll, svchost_helper.dll, setup_helper.exe, or taskhost_svc.exe. Delete any files that don't belong. Use a tool like Autoruns (from Microsoft Sysinternals) to identify any startup entries or services that reference these files.
Remove malicious registry keys and services
Open Registry Editor (regedit.exe) and navigate to HKLM\SYSTEM\CurrentControlSet\Services\. Look for services named after the vulnerable driver or with suspicious DisplayName values. Delete the entire service key. Also check HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for entries pointing to the deleted files. Remove any you find.
Restore kernel callback integrity
This is the hardest part and typically requires specialized tools. FudModule's damage persists in memory even after you delete the files. The cleanest approach is to reboot immediately after file removal—this restores kernel callbacks to their default state. However, if the machine is part of a domain or uses centrally managed security software, consult your IT team or a professional technician before rebooting to ensure security agents will re-register properly.
Verify security software functionality
After rebooting, open your antivirus, EDR agent, or Windows Defender. Run a full system scan. Check that real-time protection is enabled and that logs are being generated. If your security tools still report errors, reinstall them completely—FudModule may have corrupted their binaries or configuration files.
Scan for secondary infections
FudModule is rarely deployed alone. Run a second full scan with a different tool (Malwarebytes, ESET Online Scanner, or Microsoft Safety Scanner). Check for ransomware, backdoors, or data exfiltration tools that may have piggybacked on FudModule's disablement of your defenses. Review your browser history, recent downloads, and outbound firewall logs if available.
Change all credentials immediately
Because FudModule is typically deployed by an attacker with administrative access, assume your passwords have been compromised. Change your Windows login password, domain password (if applicable), and all saved passwords in browsers and password managers. Enable multi-factor authentication (MFA) on every account that supports it, especially email and financial services.
Document and report the incident
Take screenshots of anything suspicious you found—file paths, registry keys, error messages. If this is a business machine, report the incident to your IT department or managed security provider immediately. For home users: consider filing a report with the FBI's Internet Crime Complaint Center (IC3) if financial loss or identity theft occurred. Save forensic evidence in case law enforcement or your cybersecurity insurance provider needs it.
Prevention
- Harden driver loading policies: Enable Windows Driver Signature Enforcement and consider using Microsoft Vulnerable Driver Blocklist (available via Windows Update and group policy). This prevents many BYOVD exploits, though sophisticated attackers may still find workarounds.
- Deploy EDR with kernel-level attestation: Modern endpoint detection and response (EDR) platforms can detect when kernel callbacks are removed or when vulnerable drivers are loaded. If you're running a business network, invest in EDR that monitors for BYOVD techniques specifically.
- Limit administrative privileges: FudModule requires admin rights to load its driver. Use standard user accounts for daily tasks and only elevate to administrator when necessary. This limits the attacker's ability to deploy kernel-mode malware even after initial compromise.
- Keep drivers and firmware updated: Vulnerable drivers are the entry point. Use Windows Update, manufacturer utilities, and tools like Driver Booster or Snappy Driver Installer to ensure your drivers are current. Remove any drivers for hardware you no longer use.
- Monitor for anomalous driver activity: Use Sysmon (part of Sysinternals) to log driver loads and configure alerts for drivers loaded from unusual paths (e.g.,
C:\ProgramData\,C:\Temp\). Security teams should track these events centrally. - Network segmentation and least privilege: If one machine in your network is compromised, segmentation prevents lateral movement. Don't give every user or device access to every resource. Use VLANs, firewalls, and Zero Trust principles.
- Regular offline backups: While FudModule itself doesn't destroy data, it often precedes ransomware. Maintain offline, encrypted backups of critical data and test your restore process quarterly. Follow the 3-2-1 rule: three copies, two media types, one offsite.
- Security awareness training: Teach employees and family members to recognize phishing, avoid suspicious downloads, and report anomalies. FudModule doesn't arrive in a vacuum—it follows an initial compromise, which is often preventable.
Bring It In
FudModule is not a typical home-user malware infection. If you've encountered it, you're likely dealing with a targeted attack or a breach that extends beyond a single machine. This is the kind of threat that justifies professional forensic analysis. Our team at Computer Repair Roswell has the tools and expertise to image your drive, identify IOCs, restore kernel integrity, and verify that no secondary infections remain. We work offline when necessary, document everything, and walk you through what happened so you can prevent it from happening again.
We're located at 1945 Mountain Industrial Blvd, Roswell, Georgia, just a few minutes from Holcomb Bridge Road and GA-400. Drop by Monday through Friday, 10 AM to 6 PM, or call us at (770) 674-4661 to describe your situation. If your machine is part of a business network, let us know—we can coordinate with your IT team or MSP to ensure the removal doesn't disrupt domain policies or centrally managed security tools. Don't let a blinded system become the gateway for the next attack. Bring it in, and let's restore your defenses the right way.