New Ransomware Exploits Malicious Driver to Remove Security Protection
A ransomware family known as Hyadina is using malicious, Microsoft-signed drivers to disable security software on infected endpoints. The attackers gain initial access through compromised accounts before deploying tools to steal credentials and encrypt data.
Why it matters
The use of legitimate digital signatures on malicious drivers represents a significant escalation in malware sophistication, making it harder for standard security tools to detect threats.
The latest incarnation of a family of ransomware which has been hitting organizations since 2022 has evolved to exploit Microsoft-signed malicious drivers to prevent endpoint defenses from detecting and disrupting its attacks.
The article provides a technical, factual report on cybersecurity threats without political or social framing.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in