Microsoft Windows: 'Download More RAM' Attack Bypasses VBS and HVCI to Disable Defender

Researchers from the University of Birmingham have identified a critical vulnerability chain termed the 'Download More RAM' attack, which targets the Windows Hypervisor. By exploiting memory mapping flaws and virtualization handlers, the attack executes primitives to bypass Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI). This bypass allows for kernel-mode privilege escalation, enabling the execution of scripts that manipulate the Windows registry to disable Microsoft Defender and other core security mechanisms. The attack effectively creates a systemic 'kill-switch,' neutralizing hardware-backed isolation and preventing standard security alerts from triggering during the defense-neutralization phase.

• Research & Discovery Overview

  • Identified by University of Birmingham security researchers.
  • Scheduled for technical presentation at the USENIX Security '26 session.
  • Focuses on fundamental flaws in Windows memory management and virtualization isolation layers.

• Vulnerability Mechanics & Deep Dive

  • Hypervisor Exploitation: Leverages memory mapping exploits specifically targeting the Windows Hypervisor architecture.
  • Security Bypass: Utilizes HVCI bypass primitives to undermine hypervisor-protected code integrity.
  • Memory Manipulation: Employs VBS memory manipulation scripts to neutralize virtualization-based security layers.
  • Privilege Escalation: Facilitates kernel-mode privilege escalation via flaws in virtualization handlers.

• Security Neutralization (The 'Kill-Switch')

  • Defender Disablement: Executes logic to disable Microsoft Defender through direct registry manipulation.
  • Stealth Execution: Designed to bypass standard security alerts during the deactivation of antivirus mechanisms.
  • Low Barrier to Entry: Utilizes script-based execution, allowing for highly automated and rapid deployment.

• Enterprise Impact & Risk Profile

  • Defense Neutralization: Completely undermines VBS and HVCI, which serve as the foundation for modern Windows hardening.
  • High-Risk Environments: Threatens enterprise infrastructures that rely on virtualization-based isolation for malware containment and kernel protection.
  • Systemic Vulnerability: Creates a path for attackers to render endpoint protection entirely ineffective without user interaction.

• Mitigation & Defensive Response

  • Vendor Coordination: Findings are being addressed through the Microsoft Security Response Center (MSRC).
  • Detection Strategy: Organizations should prioritize monitoring for unauthorized registry modifications and anomalous kernel-mode activity.
  • Defense-in-Depth: Highlights the necessity of layered telemetry to detect successful hypervisor-level compromises.