BYOVD Archives • Daily CyberSecurity

Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT Cambodia malware campaign infection chain diagram showing SparkRAT delivery and BYOVD driver abuse

Cambodia malware campaign infection chain diagram showing SparkRAT delivery and BYOVD driver abuse

Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT

Do Son September 1, 2026

At a Glance Actor/Group Unattributed cluster; low-confidence overlap with SilverFox-associated activity Activity Multi-stage malware campaign delivering SparkRAT...

UAT-10147 Deploys SPECTRE Cross-Platform Implant Diagram showing how the UAT-10147 SPECTRE cross-platform implant bypasses EDR systems

UAT-10147 Deploys SPECTRE Cross-Platform Implant

Do Son August 31, 2026

At a glance Factor Details Actor or Group UAT-10147 (Suspected Chinese-speaking group) Activity Type SEO fraud monetization,...

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

Do Son August 27, 2026

At a glance Malware family Cruciferra malware loader (delivers Remus stealer) Threat actor Cruciferra and LenAI (ErrTraffic)...

BTR.sys Driver Abuse Turns Defender Into an EDR/AV Bypass Diagram of BTR.sys driver abuse showing the signed Defender remediation driver used as an EDR/AV bypass kernel primitive

Diagram of BTR.sys driver abuse showing the signed Defender remediation driver used as an EDR/AV bypass kernel primitive

BTR.sys Driver Abuse Turns Defender Into an EDR/AV Bypass

Do Son August 25, 2026

At a Glance Research BTR Reforged (Check Point Research) Component BTR.sys, the Windows Defender Boot-Time Removal driver...

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools

Do Son July 31, 2026

At a Glance Actor / group SilverFox (Silver Fox), a China-aligned APT tracked since about 2022 Activity...

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call...

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses

Do Son July 15, 2026

At a Glance Malware family GodDamn ransomware (rebrand of Beast, formerly Monster) Threat actor Hyadina, a ransomware-as-a-service...

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools

Do Son July 2, 2026

At a glance Group The Gentlemen (ransomware-as-a-service) Activity Ransomware, data-leak extortion, custom tool development Targets Large firms...

vendor-signed UEFI applications Secure Boot bypass via BYOVD attack and UEFI DBX revocation

Vendor-Signed UEFI Applications Allow Secure Boot Bypass

Do Son June 23, 2026

TL;DR CERT/CC disclosed a Secure Boot bypass that affects many vendor-signed UEFI applications. ESET researcher Martin Smolar...

DragonForce Hides Backdoor C2 Inside Microsoft Teams TURN Relays North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

DragonForce Hides Backdoor C2 Inside Microsoft Teams TURN Relays

Do Son June 22, 2026

At a glance Malware family Backdoor.Turn (Go-based RAT) Threat actor DragonForce ransomware, developed by Hackledorb (Symantec attribution)...

Warlock Ransomware Evolves: New Tools and Kernel-Level Evasion Threaten Global Sectors EV2GO Charging Platform ICSA-26-057-04 Lazarus Group, Crypto Hacks LazyStealer

EV2GO Charging Platform ICSA-26-057-04 Lazarus Group, Crypto Hacks LazyStealer

Warlock Ransomware Evolves: New Tools and Kernel-Level Evasion Threaten Global Sectors

Do Son March 19, 2026

The Warlock ransomware group (also tracked as Water Manaul) has significantly sharpened its claws. A recent deep-dive...

The Resume Trap: How ‘BlackSanta’ Malware Uses Fake CVs to Blind EDRs and Hijack HR Systems Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

The Resume Trap: How ‘BlackSanta’ Malware Uses Fake CVs to Blind EDRs and Hijack HR Systems

Do Son March 18, 2026

Aryaka Threat Labs has unmasked a sophisticated malware operation dubbed BlackSanta. This Russian-speaking threat actor has spent...

Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind Antivirus INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind Antivirus

Do Son February 10, 2026

The notorious Black Basta ransomware group has upgraded its arsenal with a dangerous new capability, embedding defense...

Game Over: Interlock Ransomware Weaponizes Anti-Cheat Zero-Day to Kill EDR Interlock Ransomware Anti-Cheat BYOVD

Game Over: Interlock Ransomware Weaponizes Anti-Cheat Zero-Day to Kill EDR

Do Son February 4, 2026

A sophisticated ransomware group known as Interlock is turning the tables on defenders by weaponizing a tool...

“Osiris” Rises: New Ransomware Targets Southeast Asian Food Giant with Advanced Tactics Osiris Ransomware Inc Ransomware Connection CountLoader Massive Ransomware Campaign CVE-2025-0289

Osiris Ransomware Inc Ransomware Connection CountLoader Massive Ransomware Campaign CVE-2025-0289

“Osiris” Rises: New Ransomware Targets Southeast Asian Food Giant with Advanced Tactics

Do Son January 26, 2026

A new ransomware family, borrowing the name of the ancient Egyptian god of the dead, has emerged...

“VM Isolation is Not Absolute”: Researchers Unmask Sophisticated ESXi “Maestro” Exploit GUARDIANWALL MailSuite Exploit CVE-2026-32661 FileZen Vulnerability CVE-2026-25108 Ivanti EPMM Vulnerability Dormant Backdoor Fortinet Authentication Bypass CVE-2026-24858 VMware vCenter Server Flaw CVE-2025-21590

GUARDIANWALL MailSuite Exploit CVE-2026-32661 FileZen Vulnerability CVE-2026-25108 Ivanti EPMM Vulnerability Dormant Backdoor Fortinet Authentication Bypass CVE-2026-24858 VMware vCenter Server Flaw CVE-2025-21590

“VM Isolation is Not Absolute”: Researchers Unmask Sophisticated ESXi “Maestro” Exploit

Do Son January 8, 2026

In a new report, the Huntress Tactical Response Team details a sophisticated intrusion discovered in December 2025...

Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics Gentlemen Ransomware, BYOVD Double Extortion

Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics

Do Son December 17, 2025

A sophisticated new ransomware operator has rapidly ascended the ranks of the cybercriminal underworld, targeting industries across...

GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes GOLD BLADE Canada, BYOVD EDR Killer

GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes

Do Son December 12, 2025

A notorious threat group has pivoted its focus to the Great White North, unleashing a sophisticated campaign...

Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks Cuckoo Spear campaign - APT 10

Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks

Do Son December 11, 2025

A familiar threat has returned with new tricks, proving that cybercriminals don’t need sophisticated custom code to...

DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass DeadLock Ransomware, BYOVD EDR Killer

DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass

Do Son December 11, 2025

A financially motivated threat group is deploying a new ransomware strain known as “DeadLock,” utilizing advanced “Bring...

DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase DragonForce BYOVD, Conti Codebase

DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase

Do Son November 11, 2025

The Acronis Threat Research Unit (TRU) has identified a new DragonForce ransomware variant that showcases a dramatic...

Agenda Ransomware Bypasses EDR by Deploying Linux Binary on Windows via Splashtop; Steals Veeam Credentials ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

Agenda Ransomware Bypasses EDR by Deploying Linux Binary on Windows via Splashtop; Steals Veeam Credentials

Do Son October 27, 2025

Trend Research has uncovered a highly sophisticated ransomware campaign by the Agenda group, also known as Qilin,...

Critical Alert 7 Active Exploits Detected Today