Excerpt
Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities.
Elastic Security Labs has monitored a financially motivated campaign deploying MEDUSA ransomware through the use of a HEARTCRYPT-packed loader. This loader was deployed alongside a revoked certificate-signed driver from a Chinese vendor we call ABYSSWORKER, which it installs on the victim machine and then uses to target and silence different EDR vendors. This EDR-killer drive…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Auditing the auditor: Unmasking Apex AcceleratorElastic Security Labs · Published 12 Oct
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RATElastic Security Labs · Published 14 Apr
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chainsElastic Security Labs · Published 16 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
