{
  "family": "driverupdate",
  "sample_count": 13,
  "category": "pua",
  "description": "DriverUpdate (classified across security vendors under designations including PUA:Win32/DriverUpdate and Program:Win32/DriverUpdate) is a Potentially Unwanted Application and rogue driver updater utility. Distributed via pay-per-install software bundles and deceptive online system scan advertisements, DriverUpdate runs simulated hardware driver checks that falsely claim legitimate, fully functional device drivers are severely out-of-date, corrupt, or causing system instability. It demands that the victim purchase an expensive paid software subscription to download updates, while establishing persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and installing telemetry background tasks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/DriverUpdate",
    "Program:Win32/DriverUpdate",
    "DriverUpdate Scareware",
    "Rogue:Win32/DriverUpdate",
    "Win32/DriverUpdate"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/DriverUpdate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DriverUpdate is a Potentially Unwanted Application that fabricates out-of-date driver warnings to coerce users into buying subscriptions."
      }
    },
    {
      "@type": "Question",
      "name": "Are the driver warnings reported by DriverUpdate authentic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. DriverUpdate intentionally reports stable, working Microsoft drivers as critical hazards to sell licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does DriverUpdate get installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive freeware downloaders, bundled installers, and misleading online web banner advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does DriverUpdate maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes persistence keys to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove DriverUpdate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application through Windows Apps & Features, delete leftover program files in %ProgramFiles%, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end-user NOT to pay the requested fee; the reported system errors are fabricated to induce panic.",
    "Use the Windows Control Panel to uninstall the rogue application, but do not assume this fully cleans the system.",
    "Deploy a reputable enterprise anti-malware or adware removal tool (e.g., Malwarebytes, AdwCleaner) to locate and delete the hidden registry keys and scheduled tasks left behind by the uninstaller.",
    "If the software successfully updated drivers before being caught, consider rolling back the system using System Restore to prevent BSODs caused by incorrect drivers."
  ],
  "what_to_avoid": [
    "Do not input any credit card or personal information into the software's payment portal.",
    "Avoid ignoring the incident; if the user installed this, they may have unknowingly installed more severe malware from the same bundled package."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/DriverUpdate",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DriverUpdate"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.DriverUpdate Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-driverupdate"
    },
    {
      "name": "MITRE ATT&CK - Defacement: Displaying Fake Security Alerts (T1491)",
      "url": "https://attack.mitre.org/techniques/T1491/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}