Do Son DeadLock Ransomware uses BYOVD (Baidu driver exploit) and the EDRGay.exe loader to kill EDR/AV at the kernel level. It uses a custom stream cipher and deletes shadow copies to prevent recovery.
DeadLock Ransomware uses BYOVD (Baidu driver exploit) and the EDRGay.exe loader to kill EDR/AV at the kernel level. It uses a custom stream cipher and deletes shadow copies to prevent recovery.