#byovd — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #byovd, aggregated by home.social.
-
Cruciferra: il crypter da 2.000 dollari al mese che uccide gli EDR e fa sparire il malware dal disco
Proofpoint svela Cruciferra, servizio di crypter venduto su forum underground che combina BYOVD, syscall indiretti e una variante di Process Ghosting per proteggere AsyncRAT, Agent Tesla, Remcos e altri RAT usati da gruppi come TA4922. -
Cruciferra: il crypter da 2.000 dollari al mese che uccide gli EDR e fa sparire il malware dal disco
Proofpoint svela Cruciferra, servizio di crypter venduto su forum underground che combina BYOVD, syscall indiretti e una variante di Process Ghosting per proteggere AsyncRAT, Agent Tesla, Remcos e altri RAT usati da gruppi come TA4922. -
GentleKiller Framework: How Gentlemen Ransomware Disables Victims’ Security Software - https://www.redpacketsecurity.com/gentlekiller-framework-disables-victims-security-software/
-
GentleKiller Framework: How Gentlemen Ransomware Disables Victims’ Security Software - https://www.redpacketsecurity.com/gentlekiller-framework-disables-victims-security-software/
-
Ransomware Gang Disables Security Software with GentleKiller Framework
Meet GentleKiller, a sneaky framework that helps ransomware gangs disable security software by targeting over 400 processes across 48 security products at the kernel level, allowing them to run unchecked. This sinister tool uses a "bring your own vulnerable driver" technique to terminate protections and clear the way for…
#Ransomware #Gentlekiller #Byovd #EndpointDetectionAndResponse #EdrKiller
-
Ransomware Gang Disables Security Software with GentleKiller Framework
Meet GentleKiller, a sneaky framework that helps ransomware gangs disable security software by targeting over 400 processes across 48 security products at the kernel level, allowing them to run unchecked. This sinister tool uses a "bring your own vulnerable driver" technique to terminate protections and clear the way for…
#Ransomware #Gentlekiller #Byovd #EndpointDetectionAndResponse #EdrKiller
-
Exploiting Windows Drivers Without Hardware: The BYOVD Perspective
Discover how attackers can exploit Windows drivers without hardware, turning kernel-mode driver bugs into powerful tools to bypass security controls. The Atos Threat Research Center reveals a game-changing method to manipulate reachability from userland on Windows 11 23H2.
#Byovd #Windows #KernelDrivers #VulnerabilityExploitation #Windows11
-
📰 Qilin Ransomware Blinds Defenses with Advanced EDR Killer, Abusing Vulnerable Drivers
🔥 Qilin ransomware deploys a sophisticated EDR killer, using a vulnerable signed driver (BYOVD) to disable over 300 security products at the kernel level. A major escalation in defense evasion tactics. #Ransomware #Qilin #EDR #CyberSecurity #BYOVD
-
BYOVD-атаки на ядро Windows через драйверы: разбираю механику, воспроизвожу, строю защиту
Вы настроили Sysmon, у вас работает EDR, события летят в SIEM. Создаётся процесс, вы видите Event ID 1. Загружается DLL, Event ID 7. Всё под контролем. А теперь кто-то загружает в систему один .sys-файл. Обычный, подписанный, из прошлого века. И события пропадают. Не потому что Sysmon упал или EDR отключили. Они работают. Просто ядро Windows больше не считает нужным им что-то рассказывать. Я залез внутрь, чтобы понять, как это устроено. Поднял WinDbg, подключился к ядру, нашёл структуры, где хранятся callback'и мониторинга. Обнулил их, повторив технику руткита Lazarus. Sysmon на месте, PID живой, но лог пустой. Меня зовут Роман Мгоев, я специалист по анализу киберугроз в Альфа-Банке, в статье пройду этот путь целиком: начиная с архитектуры колец защиты Windows, byte-патчей в памяти ядра и разбора FudModule от Lazarus обеих версий, до свежих техник zerosalarium и разбора публичных тулкитов, а в конце поделюсь семью направлениями детектирования с готовыми правилами для SIEM. Отдельный блок — про аудит драйверов, которых ещё нет ни в одной базе.
https://habr.com/ru/companies/alfa/articles/1011302/
#BYOVD #EDR #Windows_kernel #Sysmon #SIEM #Lazarus #ransomware #reverse_engineering #SOC #detection_engineering
-
📰 New 'Osiris' Ransomware Borrows TTPs from Medusa and Inc Gangs, Uses Signed Driver to Kill AV
New Osiris ransomware borrows TTPs from Medusa & Inc gangs. 🐍 It uses a custom-signed driver ('Poortry') to kill EDR/AV before encrypting files. Also uses Rclone for data theft. #Ransomware #Osiris #BYOVD #ThreatIntel
-
DeadLock ransomware now uses a new BYOVD loader exploiting Baidu driver CVE-2024-51324 to terminate EDR processes at the kernel level. Pre-encryption PowerShell scripting disables defenses and wipes shadow copies before deploying custom time-based encryption.
https://www.technadu.com/deadlock-ransomware-uses-new-byovd-loader-exploiting-driver-vulnerability-to-disable-edr/615498/#Cybersecurity #Ransomware #BYOVD #DeadLock #EDR #ThreatIntel
-
10 популярных техник обхода EDR
Алексей Баландин, Security Vision На сегодняшний день невозможно представить защиту конечных точек без системы EDR, которая, в отличие от устаревшего антивируса, основана в первую очередь на поведенческом анализе происходящих в системе событий. Потребность в этой системе резко возросла за последние 10 лет в связи с тем, что угрозы совершенствуются из года в год. Давно стало очевидно, что эффективно противостоять атакующим можно не столько за счет статического анализа кода, сигнатурного метода, сколько за счет изучения, анализа и блокировки их поведенческих паттернов, используемых тактик, техник и процедур. Этим и занимается класс продуктов EDR и активно развивается за счет постоянного пополнения базы знаний о новых методах атак. Обратной стороной медали является то, что атакующие не стоят на месте и разрабатывают все новые способы обхода и противодействия EDR. Далее рассмотрим техники обхода EDR, которые были наиболее популярны у атакующих за последние 5 лет.
https://habr.com/ru/companies/securityvison/articles/973172/
-
[Перевод] Техники обхода систем обнаружения: маскировка путей и BYOVD
Вакансии по пентесту всё чаще требуют не только понимания принципов работы ключевых СЗИ (WAF, EDR, NAC), но и практических навыков их обхода. То же самое касается EDR/AV. В реальных отчётах о кибератаках также регулярно упоминается, как злоумышленники обходят средства защиты и остаются незамеченными. Предлагаем рассмотреть пару приемов таких обходов и проверить, готовы ли ваши системы защиты к подобным вызовам.
https://habr.com/ru/companies/cloud4y/articles/962456/
#информационная_безопасность #edr #системы_защиты #мониторинг #маскировка_путей #byovd #символические_ссылки
-
🚨 EDR-Redir exploit uses Windows’ Bind & Cloud Filter drivers to redirect or isolate EDR folders from user mode - no kernel privileges required.
Demoed by TwoSevenOneT, it breaks Elastic Defend, Sophos, and even disables Defender via CFAPI corruption.
Minifilter abuse is becoming the new weak link in EDR design.
💬 Thoughts on how vendors should adapt?
Follow TechNadu for continuous#ThreatResearch and #EDREvasion updates.
#InfoSec #CyberSecurity #EDR #BYOVD #WindowsSecurity #MalwareAnalysis #RedTeam -
State of ransomware in 2025 – Source: securelist.com https://ciso2ciso.com/state-of-ransomware-in-2025-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #Crossplatformmalware #CyberSecurityNews #MalwareStatistics #Financialthreats #MicrosoftWindows #Targetedattacks #DataEncryption #securelistcom #Publications #ransomware #Lockbit #BYOVD #RaaS #APT #LLM #AI
-
State of ransomware in 2025 – Source: securelist.com https://ciso2ciso.com/state-of-ransomware-in-2025-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #Crossplatformmalware #CyberSecurityNews #MalwareStatistics #Financialthreats #MicrosoftWindows #Targetedattacks #DataEncryption #securelistcom #Publications #ransomware #Lockbit #BYOVD #RaaS #APT #LLM #AI
-
An APT group exploited ESET flaw to execute malware – Source: securityaffairs.com https://ciso2ciso.com/an-apt-group-exploited-eset-flaw-to-execute-malware-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #ToddyCatAPT #Security #hacking #BYOVD #eset #APT
-
An APT group exploited ESET flaw to execute malware – Source: securityaffairs.com https://ciso2ciso.com/an-apt-group-exploited-eset-flaw-to-execute-malware-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #ToddyCatAPT #Security #hacking #BYOVD #eset #APT
-
How ToddyCat tried to hide behind AV software – Source: securelist.com https://ciso2ciso.com/how-toddycat-tried-to-hide-behind-av-software-source-securelist-com/ #Vulnerabilitiesandexploits #AntivirusVulnerabilities #rssfeedpostgeneratorecho #zerodayvulnerabilities #APT(Targetedattacks) #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Defenseevasion #Windowsmalware #securelistcom #Encryption #Incidents #ToddyCat #Drivers #Malware #Trojan #BYOVD #APT #CVE #DLL
-
How ToddyCat tried to hide behind AV software – Source: securelist.com https://ciso2ciso.com/how-toddycat-tried-to-hide-behind-av-software-source-securelist-com/ #Vulnerabilitiesandexploits #AntivirusVulnerabilities #rssfeedpostgeneratorecho #zerodayvulnerabilities #APT(Targetedattacks) #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Defenseevasion #Windowsmalware #securelistcom #Encryption #Incidents #ToddyCat #Drivers #Malware #Trojan #BYOVD #APT #CVE #DLL
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code – Source:hackread.com https://ciso2ciso.com/canon-printer-drivers-flaw-could-let-hackers-run-malicious-code-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #Microsoft #Hackread #security #Printer #BYOVD #Canon #IoT
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code – Source:hackread.com https://ciso2ciso.com/canon-printer-drivers-flaw-could-let-hackers-run-malicious-code-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #Microsoft #Hackread #security #Printer #BYOVD #Canon #IoT
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code https://hackread.com/canon-printer-drivers-flaw-hackers-run-malicious-code/ #Cybersecurity #Vulnerability #Microsoft #Security #Printer #BYOVD #Canon #IoT
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code https://hackread.com/canon-printer-drivers-flaw-hackers-run-malicious-code/ #Cybersecurity #Vulnerability #Microsoft #Security #Printer #BYOVD #Canon #IoT
-
Checkpoint ZoneAlarm Driver Flaw Exposes Users to Credential Theft – Source:hackread.com https://ciso2ciso.com/checkpoint-zonealarm-driver-flaw-exposes-users-to-credential-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #0CISO2CISO #CheckPoint #ZoneAlarm #Hackread #security #Windows #BYOVD
-
Checkpoint ZoneAlarm Driver Flaw Exposes Users to Credential Theft – Source:hackread.com https://ciso2ciso.com/checkpoint-zonealarm-driver-flaw-exposes-users-to-credential-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #0CISO2CISO #CheckPoint #ZoneAlarm #Hackread #security #Windows #BYOVD
-
Checkpoint ZoneAlarm Driver Flaw Exposes Users to Credential Theft https://hackread.com/checkpoint-zonealarm-driver-flaw-user-credential-theft/ #Cybersecurity #Vulnerability #CheckPoint #ZoneAlarm #Security #Windows #BYOVD
-
Checkpoint ZoneAlarm Driver Flaw Exposes Users to Credential Theft https://hackread.com/checkpoint-zonealarm-driver-flaw-user-credential-theft/ #Cybersecurity #Vulnerability #CheckPoint #ZoneAlarm #Security #Windows #BYOVD
-
#BYOVD Attack: Researchers found a flaw in Checkpoint’s ZoneAlarm antivirus driver that could let attackers bypass Windows security and steal data.
Read: https://hackread.com/checkpoint-zonealarm-driver-flaw-user-credential-theft/
-
#BYOVD Attack: Researchers found a flaw in Checkpoint’s ZoneAlarm antivirus driver that could let attackers bypass Windows security and steal data.
Read: https://hackread.com/checkpoint-zonealarm-driver-flaw-user-credential-theft/
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks – Source: www.securityweek.com https://ciso2ciso.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks-source-www-securityweek-com/ #rssfeedpostgeneratorecho #privilegeescalation #CyberSecurityNews #vulnerabilities #securityweekcom #securityweek #ransomware #driver #BYOVD
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks – Source: www.securityweek.com https://ciso2ciso.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks-source-www-securityweek-com/ #rssfeedpostgeneratorecho #privilegeescalation #CyberSecurityNews #vulnerabilities #securityweekcom #securityweek #ransomware #driver #BYOVD
-
BYOVD Attacks in Paragon Partition Manager: Zero-Day Exploited Revealed - https://www.redpacketsecurity.com/byovd-attacks-exploit-zero-day-in-paragon-partition-manager/
-
BYOVD Attacks in Paragon Partition Manager: Zero-Day Exploited Revealed - https://www.redpacketsecurity.com/byovd-attacks-exploit-zero-day-in-paragon-partition-manager/
-
BYOVD Attacks Exploit Zero-Day in Paragon Partition Manager – Source: www.infosecurity-magazine.com https://ciso2ciso.com/byovd-attacks-exploit-zero-day-in-paragon-partition-manager-source-www-infosecurity-magazine-com/ #rssfeedpostgeneratorecho #InfoSecurityMagazine #InfosecurityMagazine #CyberSecurityNews #BYOVD
-
BYOVD Attacks Exploit Zero-Day in Paragon Partition Manager – Source: www.infosecurity-magazine.com https://ciso2ciso.com/byovd-attacks-exploit-zero-day-in-paragon-partition-manager-source-www-infosecurity-magazine-com/ #rssfeedpostgeneratorecho #InfoSecurityMagazine #InfosecurityMagazine #CyberSecurityNews #BYOVD
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks https://www.securityweek.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks/ #privilegeescalation #Vulnerabilities #ransomware #driver #BYOVD
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks https://www.securityweek.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks/ #privilegeescalation #Vulnerabilities #ransomware #driver #BYOVD
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks https://www.securityweek.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks/ #privilegeescalation #Vulnerabilities #ransomware #driver #BYOVD
-
Vulnerable Paragon Driver Exploited in Ransomware Attacks https://www.securityweek.com/vulnerable-paragon-driver-exploited-in-ransomware-attacks/ #privilegeescalation #Vulnerabilities #ransomware #driver #BYOVD
-
#BYOVD attacks are slowly becoming more common for threat actors to escalate privilege and kill security tools.
Make sure you're #ThreatHunting for new Vulnerable Drivers!
Win 11 now has a Vulnerable Driver Blocklist feature, however, it's only updated in major updates so you still need to monitor for recently discovered Vulnerable Drivers.Recent Vuln Driver: https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
Known Vuln Drivers: https://www.loldrivers.io/
Vuln Driver Blocklist: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
-
#BYOVD attacks are slowly becoming more common for threat actors to escalate privilege and kill security tools.
Make sure you're #ThreatHunting for new Vulnerable Drivers!
Win 11 now has a Vulnerable Driver Blocklist feature, however, it's only updated in major updates so you still need to monitor for recently discovered Vulnerable Drivers.Recent Vuln Driver: https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
Known Vuln Drivers: https://www.loldrivers.io/
Vuln Driver Blocklist: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
-
Ransomware gangs exploit a Paragon Partition Manager BioNTdrv.sys driver zero-day – Source: securityaffairs.com https://ciso2ciso.com/ransomware-gangs-exploit-a-paragon-partition-manager-biontdrv-sys-driver-zero-day-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #CyberCrime #Cybercrime #hacking #Malware #BYOVD
-
Ransomware gangs exploit a Paragon Partition Manager BioNTdrv.sys driver zero-day – Source: securityaffairs.com https://ciso2ciso.com/ransomware-gangs-exploit-a-paragon-partition-manager-biontdrv-sys-driver-zero-day-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #CyberCrime #Cybercrime #hacking #Malware #BYOVD
-
Malware campaign abused flawed Avast Anti-Rootkit driver – Source: securityaffairs.com https://ciso2ciso.com/malware-campaign-abused-flawed-avast-anti-rootkit-driver-source-securityaffairs-com/ #MalwarecampaignabusedflawedAvastAntiRootkitdriver #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #CyberCrime #hacking #Malware #BYOVD
-
Malware campaign abused flawed Avast Anti-Rootkit driver – Source: securityaffairs.com https://ciso2ciso.com/malware-campaign-abused-flawed-avast-anti-rootkit-driver-source-securityaffairs-com/ #MalwarecampaignabusedflawedAvastAntiRootkitdriver #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #CyberCrime #hacking #Malware #BYOVD
-
Advanced threat predictions for 2025 – Source: securelist.com https://ciso2ciso.com/advanced-threat-predictions-for-2025-source-securelist-com/ #Vulnerabilitiesandexploits #KasperskySecurityBulletin #rssfeedpostgeneratorecho #ArtificialIntelligence #APT(Targetedattacks) #CyberSecurityNews #Supplychainattack #internetofthings #machinelearning #Targetedattacks #GoogleAndroid #securelistcom #Triangulation #Hacktivists #deepfakes #AppleiOS #backdoor #botnets #Drivers #BYOVD #APT #XZ
-
Advanced threat predictions for 2025 – Source: securelist.com https://ciso2ciso.com/advanced-threat-predictions-for-2025-source-securelist-com/ #Vulnerabilitiesandexploits #KasperskySecurityBulletin #rssfeedpostgeneratorecho #ArtificialIntelligence #APT(Targetedattacks) #CyberSecurityNews #Supplychainattack #internetofthings #machinelearning #Targetedattacks #GoogleAndroid #securelistcom #Triangulation #Hacktivists #deepfakes #AppleiOS #backdoor #botnets #Drivers #BYOVD #APT #XZ
-
Grzegorz Tworek na scenie OMH 2023 pojawił się dwukrotnie. W pierwszej prelekcji skupił się na BYOVD. Nawet jeżeli nie do końca wiemy, dlaczego tak jest, to powszechnie uważa się, że kernelowi wolno w systemie Windows więcej, więc nie każdy ma tam wstęp. W szczególności wcale nie chcemy wpuścić tam malware. A co, gdyby malware nie działał w trybie jądra i zamiast tego posłużył się zupełnie legalnym kawałkiem kodu, który już tam jest?
-
Grzegorz Tworek na scenie OMH 2023 pojawił się dwukrotnie. W pierwszej prelekcji skupił się na BYOVD. Nawet jeżeli nie do końca wiemy, dlaczego tak jest, to powszechnie uważa się, że kernelowi wolno w systemie Windows więcej, więc nie każdy ma tam wstęp. W szczególności wcale nie chcemy wpuścić tam malware. A co, gdyby malware nie działał w trybie jądra i zamiast tego posłużył się zupełnie legalnym kawałkiem kodu, który już tam jest?
-
The two drivers we've seen abused are known in the industry as #BYOVD payloads. One is a file called RentDrv2 (hosted on https://github.com/keowu/BadRentdrv2) and the other is named ThreatFireMonitor (also on Github, with a proof of concept at https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer).
No matter which driver gets used, #EDRKillShifter writes them out to the %temp% directory using a random 10-digit filename. 5/
-
The two drivers we've seen abused are known in the industry as #BYOVD payloads. One is a file called RentDrv2 (hosted on https://github.com/keowu/BadRentdrv2) and the other is named ThreatFireMonitor (also on Github, with a proof of concept at https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer).
No matter which driver gets used, #EDRKillShifter writes them out to the %temp% directory using a random 10-digit filename. 5/