Loading story…
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility Defender Control being used in real intrusions by groups such as Dharma, Phobos, and Crysis, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, LockBit 2.0 automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries.
More recent intrusions show the tactic evolving beyond simple utilities into BYOVD and broader policy abuse. WithSecure reported that the CrazyHunter ransomware actor used the vulnerable Zemana Anti-Logger driver zam64.sys to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as SharpGPOAbuse for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Get the actors, campaigns, and ATT&CK mapping behind it.
11 events from the most recent confirmed update back to the earliest known activity.
WithSecure reported that CrazyHunter attacks began in early 2025 and were involved in multiple incidents, mostly targeting hospitals and some industrial organizations in Taiwan.
The DFIR Report attributed YARA rules for DefenderControl.exe and DefenderControl.ini to itself and dated those rules 2020-12-05 to support detection of the utility in intrusions.
The analyzed Defender Control sample was version 1.6, and the report states it was dated 2020-10-12.
The LockBit ransomware operation launched in September 2019 as a ransomware-as-a-service scheme, recruiting affiliates to breach networks and deploy the malware.
The intrusion also used bb.exe to load Donut-generated shellcode from the ransomware payload and gpo.exe identified as SharpGPOAbuse for GPO-based lateral movement and persistence.
WithSecure found the CrazyHunter encrypter was built from the open-source Prince Ransomware builder and appeared in artifacts as go3.exe and crazyhunter.exe.
In the Mackay Memorial Hospital intrusion, the threat actor used the vulnerable Zemana Anti-Logger driver zam64.sys in a BYOVD technique to terminate Windows Defender and Trend Micro protections.
A CrazyHunter ransomware intrusion affected Mackay Memorial Hospital in Taiwan, with the initial access reportedly involving a USB device.
A new LockBit 2.0 capability was observed that, when run on a domain controller, creates group policies to disable Microsoft Defender, pushes them across the domain, and schedules ransomware execution on endpoints.
Samples of LockBit 2.0 were discovered by MalwareHunterTeam and analyzed by BleepingComputer and Vitali Kremez, revealing domain-wide deployment via Active Directory group policies.
The DFIR Report published analysis showing Defender Control had been observed in multiple intrusions, particularly among smaller ransomware operators such as Dharma, Phobos, and Crysis using exposed RDP access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
labs.withsecure.com
Open sourcesordum.org
Open sourcebleepingcomputer.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
The **Hyadina** ransomware operation has deployed its newly rebranded **GodDamn** locker against U.S. organizations, using a signed kernel driver called **PoisonX** to weaken endpoint protections before encryption. Symantec linked GodDamn to the earlier **Beast** and **Monster** ransomware families, describing it as the latest rebrand in the same lineage. In the investigated intrusion, the attackers used **AnyDesk** for remote access, **PsExec** for lateral movement, and a broad credential-theft toolkit built around **Mimikatz** and multiple **NirSoft** utilities, while also using a fake Symantec-branded evasion tool to install the malicious driver. PoisonX, signed through Microsoft’s Hardware Compatibility process, was used in a **bring your own vulnerable driver**-style tactic to terminate security processes and remove user-mode API hooks, reducing the effectiveness of endpoint defenses. Symantec said the attackers established persistence and unattended remote access across at least 10 hosts before ransomware binaries were detected, with suspicious AnyDesk activity preceding lateral movement and final deployment by several days. Researchers said the case shows Hyadina’s increasing reliance on dual-use and open-source tools, while also underscoring concerns that Microsoft’s vulnerable driver blocklist may not immediately cover newly identified malicious or dangerous drivers.
Aug 11, 2026
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026