@sophossecurity.bsky.social
Sophos blocks driver abuse, ETW tampering and ransomware even when EDR killers attack defenses.
-
IOCs: EDRKillShifter, RansomHub
-
#BYOVD #EDR #ThreatIntel

UAC-0277: oltre 100 siti ucraini trasformati in trappole ClickFix per distribuire Lunex Stealer via smart contract
il blog: insicurezzadigitale.com/uac-0277-olt...

#cybersecurity #byovd #clickfix #cyberwar #infosec #malware #phishing #trojan #ukraine
💬 Il forum: internet-forum.it/t/stanza-sec...

Microsoft-Signed Kernel Driver Abused to Disable Security Tools and Harvest Credentials

https://cybersecuritynews.com/signed-driver-disable-security-tools-and-passwords
https://flagthis.com/tldr/8455

##Microsoft ##BYOVD ##KernelExploit ##CredentialTheft

The Warlock ransomware group still exploits SharePoint vulnerabilities, hitting a water utility, a telecom firm, and more. Here is how to defend.

#WarlockRansomware #SharePoint #ToolShell #Storm2603 #Longlegs #BYOVD #CriticalInfrastructure #CyberSecurity

Lunex MaaS Platform Weaponizes AMD Driver CVE-2025-54517

https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
https://flagthis.com/tldr/7997

##AMD ##BYOVD ##Malware ##CredentialTheft ##Vulnerability

Lunex stealer uses AMD driver exploit to blind security tools and steal your crypto and browser data. #Malware #BYOVD #Lunex #Cybersecurity #BrowserSecurity #CryptoThreats https://thedailytechfeed.com/lunex-stealer-exploits-amd-driver-to-evade-detection-and-hijack-browsers/

📢 Double note de rançon INC Ransomware : BYOVD et possible courtier d'accès initial impliqués

Huntress (blog.huntress.com), publié le 23 septembre 2026. L'analyse porte sur une attaque INC ransomware détectée fin août 2026 sur…

🟡 vérification factuelle moyenne
#BYOVD #INCRansomware #Cyberveille

Fake LastPass Authenticator installer on GitHub used a signed kernel driver to kill 145 AV and EDR processes, then stole credentials, wallet files, and session data via DLL side-loading and BYOVD. #LastPass #BYOVD #Windows

Settra ransomware weaponizes RMM tools and vulnerable drivers to bypass security and lock down Windows fast. #Cybersecurity #Ransomware #SETTRA #RMM #BYOVD #WindowsSecurity thedailytechfeed.com/settra-ranso...

DeepZero: Open-source hunting for vulnerable Windows drivers

📖 Read more: www.helpnetsecurity.com/2026/09/16/v...

#cybersecurity #cybersecuritynews #opensource #BYOVD #zeroday

DeepZero is an open-source Python engine that scans Windows kernel drivers, filters likely flaws, and uses an LLM to assess exploitability. It has already uncovered verified BYOVD issues in Snappy Driver Installer. #DeepZero #BYOVD #Windows

Monday's Red Team tool - M0nCrush - github.com/DeathShotXD/...

Kernel-mode process terminator using a signed BYOVD driver (MonProcessEX.sys). Works on all Windows 10/11. No offsets, no PDB. Rust. #redteam #tool #windows #BYOVD #driver #rust #attack