Tag: process-termination

4 Attack Reports | 0 Vulnerabilities

Attack reports

Chasing the Silver Fox: Cat & Mouse in Kernel Shadows

Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-…

process termination

vulnerable driver

kernel exploitation

signature manipulation

Published: August 28, 2025

Downloadable IOCs: 16

Shedding light on the ABYSSWORKER driver

The ABYSSWORKER driver is a malicious tool used in conjunction with MEDUSA ransomware to disable anti-malware systems. It employs a HEARTCRYPT-packed loader and a revoked certificate-signed driver to target and silence EDR vendors. The driver imitates a legitimate CrowdStrike Falcon driver and uses…

process termination

file manipulation

Published: March 20, 2025

Downloadable IOCs: 2

ICS Threat Analysis: New Malware Can Kill Engineering Processes

An analysis of a public malware repository reveals a persistent presence of OT/ICS malware, with engineering workstations being a significant target. Two notable clusters were identified: Mitsubishi engineering workstation software infected with the Ramnit worm, and a new experimental malware named…

engineering workstations

process termination

Published: December 18, 2024

Downloadable IOCs: 20

Fog Ransomware – Technical Analysis

A new ransomware called Fog has been identified, affecting education and recreation centers in the United States. The threat actors gain access through compromised VPN credentials, disable Windows Defender, and deploy the ransomware. Fog is a 32-bit EXE file compiled using Microsoft Visual C/C++. I…

file-encryption

multi-threading

process-termination

service-stopping

Published: October 21, 2024

Downloadable IOCs: 1

Click here to see more Attack Reports