Do Son Acronis exposed DragonForce's evolution: the ransomware is compiled with MinGW, uses BYOVD drivers to terminate EDR, and contains fixes to prevent decryption of its Conti V3 derived codebase.
BYOVD
Trend Research has uncovered a highly sophisticated ransomware campaign by the Agenda group, also known as Qilin,...
Symantec exposed Warlock ransomware (a probable Anylock rebrand) used by China-linked Storm-2603. It exploits the SharePoint zero-day and BYOVD to disable security and encrypt files with the .x2anylock extension.
A Windows Agere Modem EoP flaw (CVE-2025-24990) under active exploit allowed arbitrary kernel R/W even when unused. Microsoft removed the driver in the October update. PoC is available.
Sophos uncovers GOLD SALEM, a new ransomware group exploiting SharePoint flaws. The group uses EDR evasion and legitimate tools to attack global targets.
Zscaler has uncovered kkRAT, a new malware targeting Chinese-speaking users. The RAT steals crypto, hijacks clipboards, and uses RMM tools for covert, long-term control.
A new report reveals the Silver Fox APT group is abusing a Microsoft-signed vulnerable driver to disable endpoint security and deploy the ValleyRAT backdoor.
Kaspersky exposes a new AV killer leveraging the legitimate ThrottleStop.sys driver to disable antivirus software and deploy MedusaLocker ransomware in a BYOVD attack.
Check Point Research uncovers Storm-2603, a China-linked APT using a custom AK47C2 framework and BYOVD tactics to deploy multiple ransomware strains simultaneously.
CrazyHunter ransomware group targets Taiwan's critical infrastructure with sophisticated attacks, using BYOVD techniques and open-source tools.
Uncover a malicious campaign targeting security drivers. Learn how attackers exploited the Avast Anti-Rootkit driver to bypass and seize control of systems.