Ransomware group is weaponizing a legitimate but vulnerable driver to disable or kill security process (AV / EDR) on victim machines.
This is accomplished through what's known as a bring-your-own-vulnerable-driver (BYOVD) attack , in which threat actors use the driver's kernel-level access to manipulate and even terminate processes that would otherwise be protected.
Implement strict driver control policies, ensuring only trusted and patched drivers can be loaded. Continuously monitor for abnormal driver activity and privilege escalation attempts to quickly detect and block BYOVD attacks.
