All news with #byovd tag

DeadLock Ransomware Uses BYOVD to Disable Endpoint Defenses

🔒 Cisco Talos detailed a campaign where a financially motivated actor deployed DeadLock ransomware using a Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint protections by exploiting a Baidu driver flaw (CVE-2024-51324). A custom loader invoked the vulnerable driver to issue kernel-level commands that killed security processes; PowerShell scripts then escalated privileges, stopped backup and security services, and erased shadow copies. The C++ payload (compiled July 2025) injects into rundll32.exe, uses a custom stream cipher with time-based keys to append ".dlock" and waits roughly 50 seconds to evade sandboxes; communications and ransom negotiations occurred via Session. Organizations should enforce MFA, maintain strong endpoint controls and keep regular offline backups.

BYOVD Loader Used to Disable EDR in DeadLock Ransomware

🔐 Cisco Talos reported a novel Bring Your Own Vulnerable Driver (BYOVD) loader used to disable endpoint security and deliver DeadLock ransomware. The attacker exploited a Baidu Antivirus driver vulnerability (CVE-2024-51324) via a loader named EDRGay.exe and driver DriverGay.sys to terminate EDR processes at kernel level. A PowerShell payload bypassed UAC, disabled Windows Defender, stopped backup and database services, and removed all volume shadow copies. DeadLock uses a custom timing-based stream cipher and extensive kill and exclusion lists to encrypt files while avoiding system corruption.

False-Flag Teams Lure Delivers ValleyRAT via SEO Poisoning

🚨 ReliaQuest attributes a false-flag SEO poisoning campaign to the actor known as Silver Fox, which has been active since November 2025 and aims to masquerade as a Russian group to mislead investigators. The campaign pushes a malicious Teams installer packaged as "MSTчamsSetup.zip" from an Alibaba Cloud URL, drops a trojanized Setup.exe, establishes exclusions in Microsoft Defender, and writes a staged installer "Verifier.exe" to the AppData profile. The loader scans for security processes, injects a malicious DLL into rundll32.exe, and reaches out to a remote server to retrieve the final ValleyRAT payload.

Scattered Spider, LAPSUS$, and ShinyHunters: SLH Collective

🕸 The nascent Scattered LAPSUS$ Hunters (SLH) collective — a merging of Scattered Spider, LAPSUS$, and ShinyHunters — has repeatedly recreated its Telegram presence, cycling channels at least 16 times since August 8, 2025. The group markets an extortion-as-a-service offering to affiliates, targets organizations including those using Salesforce, and has teased a custom ransomware family called Sh1nySp1d3r. Trustwave SpiderLabs assesses SLH as blending financially motivated crime with attention-seeking hacktivism and sophisticated brand management.

Agenda (Qilin) weaponizes Linux binaries against Windows

🛡️ Trend Micro reports that the Agenda (Qilin) ransomware group is running a Linux-based encryptor on Windows hosts to evade Windows-only detections. The actors abused legitimate RMM and file-transfer tools — including ScreenConnect, Splashtop, Veeam, and ATERA — to maintain persistence, move laterally, and execute payloads. They combined social engineering, credential theft, SOCKS proxy injection, and BYOVD driver tampering to disable EDR and compromise backups, impacting more than 700 victims since January 2025.

Qilin Ransomware Employs Linux Payloads and BYOVD Tactics

🔒 Qilin (aka Agenda, Gold Feather, Water Galura) has sharply increased operations in 2025, claiming dozens of victims monthly and peaking at 100 leak-site postings in June. Cisco Talos and Trend Micro analyses show affiliates gain initial access via leaked admin credentials, VPN interfaces and RDP, then harvest credentials with tools like Mimikatz and SharpDecryptPwd. Attackers combine legitimate remote-management software (for example AnyDesk, ScreenConnect, Splashtop) with a BYOVD vulnerable driver to disable defenses, exfiltrate data, and deploy a Linux ransomware binary on Windows systems before encrypting files and removing backups.