The ransomware groups Qilin and Warlock are using the BYOVD (Bring Your Own Vulnerable Driver) technique to disable over 300 EDR (Endpoint Detection and Response) tools by targeting the Windows kernel. Qilin employs a multi-stage attack chain involving DLL sideloading and an in-memory "EDR killer" component. Warlock combines BYOVD with exploitation of unpatched Microsoft SharePoint Server vulnerabilities. The attacks aim to neutralize security defenses at the kernel level, though no specific CVEs or exact dates were mentioned. The impact includes rendering EDR solutions inoperable, increasing the success rate of ransomware deployments.

truesight.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance.

NeacSafe64.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance. CVE: CVE-2025-45737.

The S3 Software and System Security Group @ EURECOM website.

Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

Ein neuer Information Stealer ist Teil einer vierstufigen Angriffskette der MaaS-Plattform Lunex. Das Ontinue Cyber Defence Centre hat die zugrunde liegenden Binärdateien analysiert. Besonders auffällig ist der Einsatz eines verwundbaren AMD-Treibers.

RCFlCtrl.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance.

fekern.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance. CVE: CVE-2025-14963.

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly exe

  An operational security slip by affiliates of two ransomware groups left a server exposed long enough for researchers to pull 8,257 AI-generated messages documenting how the operators ran intrusions, negotiated ransoms, and managed their victim pipeline. The logs, recovered from a directory at IP address 45.227.254.43, form one of the most detailed windows into how criminal groups are now deploying artificial intelligence to execute attacks at scale. The research, published by SOCRadar, links the activity to affiliates of INC ransomware and The Gentlemen, a data extortion group. Analysts assess the operators are Russian-speaking and function both as an intrusion team and as an infrastructure provider, leasing out their toolkit to other ransomware partners. The Framework Behind the Operation At the center of the operation sits a custom platform called Phantom, described in its own documentation as an "Autonomous Red Team Kill Chain Framework." The tool ships with 18 skill modules, a routing engine, an autopilot orchestrator, and agents written in Python and Go. It connects to OpenCode, which lets the AI select attack techniques and assign tasks to remote agents. On victim machines, those agents masquerade as Windows Update components and phone home to a domain linked to the operation. To run the AI components, operators routed prompts through OpenRouter, a commercial model aggregator, using legitimate AI models including Anthropic's claude-opus-4.6 and Moonshot AI's Kimi-K3. When models declined to help with a specific task, operators did not switch tools. They reframed the request as an "Authorized Red Team Assessment Request" and resubmitted it. That workaround appears frequently across the 133 recorded sessions. Alongside Phantom, the group built WormGPT-MCP, a layer of 32 Model Context Protocol servers that tie the AI to purpose-built tools covering everything from reconnaissance to ransom negotiation. A partner guide found on a second server advertised "55+ tools" and access to more than 9,000 proof-of-concept exploits. The name WormGPT refers to a persona prompt layered over commercial models, not a separate AI system. For persistence and communication, the group used Ghost C2, a family of three generations of polymorphic implants that route traffic through Cloudflare, Telegram, or DNS to avoid network-level detection. How They Got In The operation targeted exposed edge devices and widely used IT management software. Three vulnerabilities drove confirmed access: CVE-2024-57727, a path traversal flaw in SimpleHelp, gave the group admin passwords from 427 servers after scanning nearly 5,000; CVE-2026-35616, an authentication bypass in FortiClient EMS, allowed operators to create backdoor admin accounts across more than 4,000 managed endpoints; and CVE-2026-41940, an authentication bypass in cPanel and WHM, was used to reach small hosting providers and their clients' email servers. Credential reuse turned single points of access into full-network compromises. In at least one documented case, a single reused password opened the door to a VPN, several servers, a remote management platform, backup infrastructure, and the organization's security management tools. To suppress endpoint detection tools, operators deployed a driver-based EDR killer that abused a vulnerable Zemana driver, a technique known as Bring Your Own Vulnerable Driver. The Victim Picture Researchers identified 62 named organizations in the operational logs, with 36 located in the United States. Industrial, manufacturing, and energy firms made up the largest share of targets at roughly 16 percent. Healthcare and pharmaceuticals came in second at about 14.5 percent. Most targeted companies were smaller businesses, with 27 of 35 classifiable organizations reporting revenue below $250 million. Some were reached indirectly through a managed service provider whose admin credentials had been stolen. Four organizations ended up listed on public leak sites. The operation's timeline runs from mid-July 2026 through a live encryption event on September 30, 2026. Extortion by the Numbers The playbook prioritized data theft over encryption. Operators sifted through stolen financial records to gauge what a victim could pay, then opened contact with a text-only email carrying no ransom figure. Pressure escalated through scripted vishing calls, threats to notify customers and regulators, and hard deadlines of 24 to 72 hours before publication. Payment was planned in Monero, though researchers found no wallet or confirmed transaction records. Demand figures from recovered case files show the range of the operation. A EUR 15 million demand sent to a company called Aidon was later revised down to EUR 4 million after the operators realized they had compromised the wrong parent company. A healthcare network in Australia received demands between AUD 3 million and AUD 8 million. The Gentlemen's communications to Leo Schachter Diamonds included a four-message sequence and a vishing plan. For Trulite Glass and Aluminum, the group set up a look-alike domain, trulitesupport[.]com, to warn the company's own customers about the breach. Total spending on the operation's infrastructure is estimated at just under $24,000.

Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you. - redteamfortress/KillerLand

Scopri la configurazione sysmonconfig-2026-DC-XDR.xml. Ottimizza la detection di BYOVD, dumping di NTDS.dit, infostealer e C2 per alimentare il tuo SIEM/XDR.

Beazley Security DFIR and MXDR teams recently responded to an INC ransomware case where a multitude of BYOVD packages were deployed to disable EDR and a…

Discover how Bring Your Own Vulnerable Driver (BYOVD) tactics evolved from one-off hacker tools into a commercialized, tiered EDR-killer service economy.

NSecKrnl.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance. CVE: CVE-2025-68947.