Tag: vulnerable driver

3 Attack Reports | 0 Vulnerabilities

Attack reports

Black Basta: Defense Evasion Capability Embedded in Ransomware Payload

A recent Black Basta ransomware campaign incorporated a bring-your-own-vulnerable-driver (BYOVD) defense evasion component within the payload itself, a departure from typical practices. The ransomware exploited a vulnerable NsecSoft NSecKrnl driver to terminate security processes. This approach, pr…

defense evasion

vulnerable driver

Published: February 5, 2026

Linked vulnerabilities : CVE-2025-68947 (CVSS 5.7)

Downloadable IOCs: 6

Chasing the Silver Fox: Cat & Mouse in Kernel Shadows

Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-…

process termination

vulnerable driver

kernel exploitation

signature manipulation

Published: August 28, 2025

Downloadable IOCs: 16

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada

Nitrogen, a new ransomware strain identified in September 2024, has become a significant threat to organizations worldwide, particularly in the financial sector. It encrypts critical data and demands substantial payments for decryption, targeting industries such as finance, construction, manufactur…

data exfiltration

vulnerable driver

Published: May 20, 2025

Downloadable IOCs: 2

Click here to see more Attack Reports