🎯 BYOVD

The items that name it 21

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.key entities2026-10-29
• DFIR Radar (@DFIR_Radar) on X
  threadas classification.key entities2026-10-19
• ThreatWire (@ThreatWire_) on X
  threadas classification.key entities2026-10-10
• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  articleas classification.key entities2026-10-09
• Making sure the checks get printed
  articleas classification.key entities2026-10-08
• Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
  articleas classification.key entities2026-10-08
• Check Point Research — 28th September Threat Intelligence Report
  articleas techniques2026-09-28It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Used by INC ransomware actors to disable security tools.

• The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  writeupas techniques2026-09-21It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Attackers loaded a legitimate but vulnerable driver (hwau.exe/HwAudio service) to gain kernel-level access, typically to disable security tools before further compromise

• Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
  writeupas techniques2026-09-17It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Installation of vulnerable driver gdrv.sys to impact security tooling and crash antivirus-related services, observed in the September incident but not in July

• DeathShotXD/0xCr0ssCrush
  repoas classification.key entities2026-09-14
• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeupas techniques2026-09-08It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Signed DCRCVDrv.sys driver abused via IOCTL 0x2205c0 (no caller authorization check) to terminate EDR/security processes with ZwTerminateProcess

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas classification.key entities2026-09-03
• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas classification.key entities2026-08-07
• CVE-2026-8501: Arbitrary Process Termination in PCTCore64.sys
  writeupas classification.key entities2026-06-02
• Bullying LLMs
  writeupas techniques2026-05-13It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Loading an older WHQL-signed, non-blocklisted vendor kernel driver that provides arbitrary kernel read/write, bypassing HVCI, to satisfy the Authenticode-signed-execution requirement

• Attackers Love Your VPN To-Do List
  articleas classification.key entities2026-04-17
• They Got In Through SonicWall. Then They Tried to Kill | Huntress
  writeupas techniques2026-02-04It is written here as BYOVD (Bring Your Own Vulnerable Driver).

  Abusing a legitimate, signed but revoked-certificate forensic driver (EnPortv.sys) to gain kernel-mode code execution and bypass usermode protections

• ESXi Exploitation in the Wild
  writeupas classification.key entities2026-01-07
• Tear Down The Castle - Part 2
  writeupas classification.key entities2025-01-30
• EDR: The Great Escape - RomHack Training Review
  writeupas classification.key entities2024-09-30
• DeepZero
  repoas classification.key entities