Loading story…
BlackCat ransomware operators deployed a new signed kernel-mode driver to gain high-privilege access on Windows systems and interfere with endpoint protections before later-stage payloads were launched. The activity reflects a broader shift by sophisticated attackers toward kernel-layer techniques that can evade or disable EPP and EDR tools, allowing malicious code to remain hidden and defenses to be impaired early in the intrusion chain.
Researchers said threat actors are increasingly using rootkits as a practical way to bypass security controls, whether by developing the tooling themselves, buying it on underground markets, or obtaining code-signing certificates to make deployment appear legitimate. The report warned that such drivers can support targeted ransomware operations by suppressing detection and persistence controls, and it urged organizations to protect certificates, enforce MFA, maintain asset inventories and logging, use allowlisting, keep reliable backups, and apply layered monitoring to detect kernel-level abuse.
TTPs, infrastructure, and targeting history in one profile.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Black Basta** ransomware operators have been observed embedding a **Bring Your Own Vulnerable Driver (BYOVD)** component directly inside the ransomware payload, a shift from the more common approach of deploying an external “EDR killer” tool prior to encryption. The technique abuses a legitimate, signed but vulnerable Windows driver to gain **kernel-level** privileges and terminate security tooling (AV/EDR) on the victim host, reducing the chance defenders can stop the attack before encryption begins. Reporting attributes the finding to analysis by **Symantec** (and the **Carbon Black Threat Hunter Team**), which described the embedded-driver approach as a notable evolution in Black Basta tradecraft and consistent with broader ransomware trends toward BYOVD-based defense evasion. One account also links the activity to the **Cardinal** cybercrime group and notes the behavior had not been seen in prior Black Basta campaigns, suggesting either a retooling or a renewed operational tempo that could be adopted by other ransomware families seeking to reliably neutralize endpoint protections.
Jun 29, 2026
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Ransomware operators are using **Bring Your Own Vulnerable Driver (BYOVD)** attacks to load legitimately signed but flawed Windows kernel drivers, gain ring-0 access, and terminate security products protected by Protected Process Light (PPL). Reported examples include the WatchDog Antimalware v1.1.100 and `eb` kernel drivers, whose unauthenticated IOCTL interfaces can reportedly be abused to kill protected processes. Qilin's Killer Ultra and RansomHub's EDRKillShifter have used the technique through user-mode launchers that drop, load, and control vulnerable drivers. Defenders should detect the sequence of suspicious driver drops, rapid driver installation or loading, low-prevalence driver hashes, and subsequent termination of endpoint-security processes. Organizations should inventory and baseline deployed drivers, enforce Windows Defender Application Control (WDAC) driver policies, enable Microsoft’s Vulnerable Driver Blocklist and HVCI, maintain EDR tamper protection, and restrict administrative privileges to reduce exposure to known vulnerable drivers, including those catalogued by LOLDrivers.
Sep 28, 2026