Tag: driver abuse

4 Attack Reports | 0 Vulnerabilities

Attack reports

RONINGLOADER: DragonBreath's New Path to PPL Abuse

Elastic Security Labs uncovered a campaign by DragonBreath APT using a multi-stage loader named RONINGLOADER to deploy an updated gh0st RAT variant. The malware employs various evasion techniques targeting Chinese EDR tools, including signed driver abuse, thread-pool injection, and PPL exploitation…
apt
gh0st rat
driver abuse
2025-11-19
ppl abuse
wdac
thread-pool injection
chinese edr evasion
roningloader
Published: November 19, 2025
Downloadable IOCs: 14

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

The Gentlemen ransomware group has emerged as a sophisticated threat actor targeting multiple industries across 17 countries, with a focus on the Asia-Pacific region. Their campaign demonstrates advanced capabilities, including the use of custom tools to bypass enterprise endpoint protections, expl…
ransomware
lateral movement
data exfiltration
defense evasion
custom tools
driver abuse
2025-09-09
the gentlemen ransomware
group policy manipulation
enterprise targeting
Published: September 9, 2025
Downloadable IOCs: 0

Chasing the Silver Fox: Cat & Mouse in Kernel Shadows

Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-…
valleyrat
edr evasion
byovd
process termination
vulnerable driver
kernel exploitation
driver abuse
2025-08-28
signature manipulation
Published: August 28, 2025
Downloadable IOCs: 16

ThrottleStop driver abused to terminate AV processes

A recent incident response case in Brazil revealed a new antivirus (AV) killer software circulating since October 2024. This malware abuses the ThrottleStop.sys driver to terminate numerous antivirus processes, employing a technique known as BYOVD (Bring Your Own Vulnerable Driver). The attack bega…
ransomware
byovd
medusalocker
kernel exploitation
2025-08-06
CVE-2025-7771
driver abuse
av killer
throttlestop
Published: August 6, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports