DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass

According to Cisco Talos, DeadLock is a financially motivated ransomware that deploys BYOVD techniques to neutralise endpoint protections before encryption. The attackers use a loader named EDRGay.exe alongside a legitimate Baidu Antivirus driver file, BdApiUtil.sys, which they rename to DriverGay.sys, exploiting a vulnerability (CVE-2024-51324) that allows unprivileged users to gain kernel privileges.

The threat actor reportedly disables Windows Defender, bypasses UAC and terminates security, backup, and database services, including deleting all volume shadow copies to thwart recovery. The ransom notes indicate the malware uses a bespoke C++ binary with a time-based cryptographic key rather than standard encryption libraries, and the group does not operate a data leak site, instead directing victims to contact via an encrypted Session messenger to negotiate in Bitcoin or Monero.

Investigations also note persistence activities such as silently installing AnyDesk for remote access. The campaign, described in a December 11, 2025 report, shows the ransomware targets Windows systems with a dramatic defense-by-pass approach and a July 2025-built payload.