ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (G

ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (G

Memory Integrity no Windows 11 será ativado automaticamente em outubro de 2026. O recurso de segurança bloqueia programas de undervolt como ThrottleStop e Intel XTU, forçando usuários a escolher entre proteção e desempenho.

Das für das Verwalten von Taktraten und Spannungen von Intel-CPUs konzipierte System-Tool ThrottleStop ist in Version 9.7 erschienen.

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

Akira ransomware strikes again. This time, it has abused an Intel CPU tuning driver to stop Microsoft Defender in attacks from EDRs and security tools active on target devices. Windows defender turned off for attacks The exploited driver is called “rwdrv.sys” (used by ThrottleStop), which the hackers list as a service that allows them to gain kernel-level access. The driver is probably used to deploy an additional driver called “hlpdrv.sys,” a hostile tool that modifies Windows Defender to shut down its safety features. 'Bring your own vulnerable driver' attack Experts have termed the attack “Bring your vulnerable driver (BYOVD), where hackers use genuine logged-in drivers that have known bugs that can be exploited to get privilege escalation. The driver is later used to deploy a hostile that turns off Microsoft Defender. According to the experts, the additional driver hlpdrv.sys is “similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware.” The malware achieves this by executing regedit.exe.  Discovery of the Akira ransomware attack The technique was observed by Guidepoint Security, which noticed repeated exploitation of the rwdrv.sys driver in Akira ransomware attacks. The experts flagged this tactic due to its ubiquity in the latest Akira ransomware incidents. “This high-fidelity indicator can be used for proactive detection and retroactive threat hunting,” the report said.  To assist security experts in stopping these attacks, Guidepoint Security has offered a YARA rule for hlpdrv.sys and complete indicators of compromise (IoCs) for the two drivers, as well as their file paths and service names. SonicWall VPN attack Akira ransomware was also recently associated with SonicWall VPN attacks. The threat actor used an unknown bug. According to Guidepoint Security, it could not debunk or verify the abuse of a zero-day flaw in SonicWall VPNs by the Akira ransomware gang. Addressing the reports, SonicWall has advised to turn off SSLVPN, use two-factor authentication (2FA), remove inactive accounts, and enable Botnet/Geo-IP safety. The DFIR report has also released a study of the Akira ransomware incidents, revealing the use of Bumblebee malware loader deployed through trojanized MSI loaders of IT software tools.

Kevin Glynn, aka "Uncle Webb," our associate software author behind popular utilities such as ThrottleStop and RealTemp, developed a new utility named Counter Control, which lets you monitor and log t...

Kevin Glynn, aka "Uncle Webb," our associate software author behind popular utilities such as ThrottleStop and RealTemp, developed a new utility named Counter Control, which lets you monitor and log t...

Kevin Glynn, aka "Uncle Webb," our associate software author behind popular utilities such as ThrottleStop and RealTemp, developed a new utility named Counter Control, which lets you monitor and log t...

Como você deve ter lido em nosso tutorial sobre Undervolting, o ThrottleStop é uma das principais (senão a principal) ferramenta para realizar o undervolt do

zer0matt's Milan0day 2026 talk walks through a clean BYOVD chain: ThrottleStop.sys (CVE-2025-7771) gives arbitrary physical-memory R/W via MmMapIoSpace, used to inline-patch NtAddAtom into a temporary trampoline. Phase 1 redirects to PsLookupProcessByProcessId to lift the target's EPROCESS pointer; phase 2 redirects to PsTerminateProcess to kill the AV/EDR from kernel mode. Original bytes are restored after each shot to dodge PatchGuard. PoC: github.com/zer0matt/Milan0day2026

Descubre ThrottleStop 9.7, la nueva herramienta de TechPowerUp que mejora el control y rendimiento de tu portátil. ¡Descárgala ahora y potencia tu equipo!

YouTube video by The Throttlestop