Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:33:20 UTC
Home > List all groups > List all tools > List all groups using tool Cahnadr
 Tool: Cahnadr
Names
Cahnadr
NDriver
Category Malware
Type Rootkit
Description
(Kaspersky) Canhadr, also known as NDriver, contains low-level routines for network, IO
operations and so on. Its kernel-mode program is able to execute malicious code without
crashing the whole file system or causing Blue Screen – a remarkable achievement. Written in
pure C language, Canhadr/Ndriver provides full access to the hard drive and operating
memory despite device security restrictions, and carries out integrity control of various system
components to avoid debugging and security detection.
Information Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool Cahnadr
Changed Name Country Observed
APT groups
 Slingshot [Unknown] 2012
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e
Page 1 of 1