Tag: byovd

25 Attack Reports | 0 Vulnerabilities

Attack reports

Attackers Weaponize Microsoft Teams Relays to Stay Hidden

Attackers deploying DragonForce ransomware against a major U.S. services firm concealed their command-and-control traffic within Microsoft Teams relay infrastructure using Backdoor.Turn, a custom Go-based remote access trojan. This novel technique leverages anonymous Teams visitor tokens and TURN r…

credential theft

dll side-loading

vulnerable drivers

microsoft teams abuse

Published: June 16, 2026

Linked vulnerabilities : CVE-2025-1055 (CVSS 5.6), CVE-2025-61155, CVE-2023-52271

Downloadable IOCs: 18

Uptick in Bomgar RMM Exploitation

Since early April 2026, security researchers have observed a significant increase in attacks targeting Bomgar remote monitoring and management instances, exploiting CVE-2026-1731, a critical vulnerability disclosed in February. Threat actors have compromised Bomgar RMM to target downstream customer…

remote access tools

rmm exploitation

Published: April 17, 2026

Linked vulnerabilities : CVE-2026-1731 (CVSS 9.9)

Downloadable IOCs: 5

How a Tax Search Leads to Kernel-Mode AV/EDR Kill

A large-scale malvertising campaign targeting U.S. tax form searchers has been uncovered. The attack chain begins with Google Ads, using dual commercial cloaking services to evade detection. Victims are directed to rogue ScreenConnect installers, leading to a multi-stage crypter that ultimately dep…

Published: March 19, 2026

Downloadable IOCs: 12

EDR killers explained: Beyond the drivers

This analysis explores the ecosystem of EDR (Endpoint Detection and Response) killers, tools used by ransomware attackers to disrupt security solutions before deploying encryptors. The research, based on almost 90 EDR killers tracked in the wild, reveals that these tools are fundamental in modern r…

threat intelligence

defense evasion

cardspacekiller

tfsysmon-killer

vulnerable drivers

Published: March 19, 2026

Downloadable IOCs: 15

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

The Warlock ransomware group has enhanced its attack chain with improved methods for persistence, lateral movement, and evasion. Their updated toolset includes TightVNC, Yuze, and a persistent BYOVD technique exploiting the NSec driver. The group's primary targets were technology, manufacturing, an…

lateral movement

Published: March 16, 2026

Downloadable IOCs: 10

Massive Winos 4.0 Campaigns Target Taiwan

A series of targeted phishing campaigns in Taiwan have been observed disseminating Winos 4.0 (ValleyRat) malware and associated plugins. The attacks exploit local business processes using themes like tax audits and e-invoices. The campaigns employ various techniques including malicious LNK files, D…

dll sideloading

Published: February 22, 2026

Downloadable IOCs: 11

Black Basta: Defense Evasion Capability Embedded in Ransomware Payload

A recent Black Basta ransomware campaign incorporated a bring-your-own-vulnerable-driver (BYOVD) defense evasion component within the payload itself, a departure from typical practices. The ransomware exploited a vulnerable NsecSoft NSecKrnl driver to terminate security processes. This approach, pr…

defense evasion

vulnerable driver

Published: February 5, 2026

Linked vulnerabilities : CVE-2025-68947 (CVSS 5.7)

Downloadable IOCs: 6

They Got In Through SonicWall. Then They Tried to Kill Every Security Tool

In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This …

driver signature enforcement

guidance software

Published: February 4, 2026

Downloadable IOCs: 2

Osiris: New Ransomware, Experienced Attackers?

A new ransomware called Osiris was used in an attack on a major food service franchisee operator in Southeast Asia in November 2025. The ransomware shares similarities with previous Inc ransomware attacks, including the use of Wasabi buckets for data exfiltration and a specific version of Mimikatz.…

Published: January 23, 2026

Downloadable IOCs: 17

New BYOVD loader behind DeadLock ransomware attack

A new loader exploiting a Baidu Antivirus driver vulnerability (CVE-2024-51324) has been discovered in connection with DeadLock ransomware attacks. The threat actor uses the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate endpoint detection and response processes. A PowerShell scrip…

Published: December 10, 2025

Linked vulnerabilities : CVE-2024-51324 (CVSS 3.8)

Downloadable IOCs: 5

Sharpening the knife: strategic evolution of GOLD BLADE

GOLD BLADE, a threat group previously focused on cyberespionage, has evolved into a hybrid operation combining data theft with selective ransomware deployment. The group has refined its intrusion methods, shifting from traditional phishing to abusing recruitment platforms for delivering weaponized …

recruitment platforms

Published: December 6, 2025

Downloadable IOCs: 28

The DragonForce Cartel: Scattered Spider at the gate

DragonForce, a ransomware-as-a-service group active since 2023, has rebranded as a cartel and formed alliances with groups like Scattered Spider, LAPSUS$, and ShinyHunters. The group uses Conti-derived code and employs BYOVD attacks to terminate processes. DragonForce has expanded its affiliate pro…

social engineering

affiliate program

scattered spider

Published: November 5, 2025

Downloadable IOCs: 0

Jewelbug: Chinese APT Group Widens Reach to Russia

A Chinese APT group named Jewelbug has expanded its operations to target organizations in South America, South Asia, Taiwan, and Russia. The group's recent intrusion into a Russian IT service provider lasted for five months in 2025, potentially aiming for a supply chain attack. Jewelbug has deploye…

dll sideloading

Published: October 24, 2025

Downloadable IOCs: 27

Technical Analysis of kkRAT

A malware campaign targeting Chinese-speaking users has been identified, delivering three types of malware: ValleyRAT, FatalRAT, and kkRAT. The campaign uses fake installer pages to distribute the malware. kkRAT, a new Remote Access Trojan, shares similarities with Ghost RAT and Big Bad Wolf. It em…

remote access trojan

chinese-speaking

Published: September 10, 2025

Downloadable IOCs: 0

Chasing the Silver Fox: Cat & Mouse in Kernel Shadows

Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-…

process termination

vulnerable driver

kernel exploitation

signature manipulation

Published: August 28, 2025

Downloadable IOCs: 16

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Dr…

Published: August 8, 2025

Downloadable IOCs: 2

ThrottleStop driver abused to terminate AV processes

A recent incident response case in Brazil revealed a new antivirus (AV) killer software circulating since October 2024. This malware abuses the ThrottleStop.sys driver to terminate numerous antivirus processes, employing a technique known as BYOVD (Bring Your Own Vulnerable Driver). The attack bega…

kernel exploitation

Published: August 6, 2025

Downloadable IOCs: 0

Qilin Ransomware and the Hidden Dangers of BYOVD

This analysis examines a recent incident involving Qilin ransomware, highlighting the evolving tactics of cybercriminals to evade Endpoint Detection and Response (EDR) systems. The attackers utilized a previously unknown driver, TPwSav.sys, to disable EDR measures through a technique known as bring…

Published: July 31, 2025

Downloadable IOCs: 7

CrazyHunter Campaign Targets Taiwanese Critical Sectors

The CrazyHunter ransomware group has emerged as a significant threat, specifically targeting Taiwanese organizations in healthcare, education, and industrial sectors. The group employs sophisticated techniques, including the Bring Your Own Vulnerable Driver (BYOVD) method, to bypass security measur…

prince ransomware

prince ransomware builder

critical sectors

open-source tools

gpo exploitation

Published: April 16, 2025

Downloadable IOCs: 9

How ToddyCat tried to hide behind AV software

The ToddyCat APT group has developed a sophisticated tool called TCESB to stealthily execute payloads and evade detection. This tool exploits a vulnerability (CVE-2024-11859) in ESET Command line scanner for DLL proxying, using a modified version of the open-source EDRSandBlast malware. TCESB emplo…

kernel manipulation

Published: April 7, 2025

Downloadable IOCs: 0

Shifting the sands of RansomHub's EDRKillShifter

ESET researchers analyze the ransomware ecosystem in 2024, focusing on the newly emerged RansomHub gang. They uncover connections between RansomHub affiliates and rival gangs Play, Medusa, and BianLian through the use of EDRKillShifter, a custom EDR killer developed by RansomHub. The researchers le…

Published: March 27, 2025

Downloadable IOCs: 0

EDR Bypass Testing Reveals Extortion Actor's Toolkit

Unit 42 investigated an extortion attempt where threat actors tested an AV/EDR bypass tool on rogue systems with Cortex XDR installed. The actors purchased network access via Atera RMM and used a BYOVD technique for the bypass tool. Researchers gained visibility into the actors' systems, uncovering…

cybercrime forums

threat actor profiling

Published: November 2, 2024

Downloadable IOCs: 0

Embargo ransomware: Rock'n'Rust

ESET researchers have uncovered new Rust-based tools used by the Embargo ransomware group. The toolkit includes MDeployer, a loader that deploys MS4Killer and Embargo ransomware, and MS4Killer, an EDR killer that exploits a vulnerable driver. Embargo, first observed in June 2024, is a relatively ne…

embargo ransomware

safe mode abuse

Published: October 23, 2024

Downloadable IOCs: 0

New RansomHub attack uses TDSKiller and LaZagne, disables EDR

A recent analysis by the ThreatDown MDR team has uncovered a novel attack method employed by the RansomHub ransomware gang. The attackers are utilizing two tools: TDSSKiller, a legitimate Kaspersky rootkit removal utility, to disable endpoint detection and response (EDR) systems, and LaZagne, a cre…

credential harvesting

network segmentation

Published: September 11, 2024

Downloadable IOCs: 2

BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks

The BlackByte ransomware group continues leveraging established tactics and vulnerable drivers to bypass security controls, while also incorporating newly disclosed vulnerabilities and using stolen credentials for propagation. A new iteration of their encryptor appends the 'blackbytent_h' extension…

Published: August 28, 2024

Downloadable IOCs: 4

Click here to see more Attack Reports