Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
Stories per day · 30 days
3 RSS
Relatedgentlemen2double-extortion1edge-devices1edrkiller1help-desk1inc1lenovo1phantom1quick-assist1ransomware1safetica1the-gentlemen1vishing1vypr1windows-defender1
28 stories, newest first · one card per story
Stories tagged #byovd
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
7
Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
Gentlemen ransomware kills security tools with Lenovo and Safetica drivers
Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.
WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM
WhatsApp-delivered fake financial statement drops VulcanRAT207.A, gaining SYSTEM via Task Scheduler injection, BYOVD, and DLL side-loading.
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
CERT-UA says over 100 hacked sites used fake Cloudflare checks to install LunexStealer via ClickFix.
3
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware operators still exploit unpatched SharePoint flaws to hit water, telecom, government, and university targets.
6
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock is exploiting SharePoint flaws to disable defenses and deploy ransomware against critical infrastructure and government targets.
5
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
4
Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
China-nexus Longlegs deploys Warlock ransomware via exploited SharePoint flaws against water utility, telecom, government, and university targets across three continents.
4
ESXi Exploitation in the Wild
Huntress stopped an intrusion that used a VMware ESXi VM-escape toolkit after SonicWall VPN access.
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
2
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer uses a Microsoft-signed driver to kill EDR, then steals passwords and wallets.
2
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Huntress reconstructed an INC ransomware attack hitting 175 endpoints and domain controllers, with two ransom notes dropped 53 minutes apart.
1
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.
2
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
Huntress details a new Settra ransomware variant deployed against retail and manufacturing victims since June, using MeshAgent RMM, recovery sabotage, and BYOVD techniques.
1
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
New SETTRA ransomware operation abuses MeshAgent RMM for persistence, BYOVD via gdrv.sys, log clearing, and Windows recovery sabotage to encrypt systems.
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Huntress details two Settra ransomware incidents where attackers deployed MeshAgent RMM and BYOVD before encrypting files.
2
DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.
ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.
7
Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
1
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
GentleKiller targets more than 400 security processes across 48 products
ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.
3