DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Threat actors associated with the DragonForce ransomware group have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to…
Tag: BYOVD
Medusa Ransomware Group
Medusa ransomware is a threat group that has previously used the custom malicious driver ABYSSWORKER in its attacks.
ABYSSWORKER Malicious Driver
ABYSSWORKER is a custom-built malicious driver used in BYOVD attacks, previously observed in Medusa ransomware incidents.
CVE-2023-52271
CVE-2023-52271 is a vulnerability associated with the driver wsftprm.sys used in BYOVD attacks by DragonForce.
CVE-2025-61155
CVE-2025-61155 is a vulnerability associated with the driver GameDriverX64.sys used in BYOVD attacks by DragonForce.
CVE-2025-1055
CVE-2025-1055 is a vulnerability associated with the driver K7RKScan.sys used in BYOVD attacks by DragonForce.
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Cybersecurity researchers have charted the evolution of INC from a nascent ransomware-as-a-service (RaaS) operation to one of the most prolific cybercrime groups…
The Gentlemen RaaS Deploys GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands…
GentleKiller: The Core EDR-Killing Framework of The Gentlemen RaaS
GentleKiller is a framework of EDR-terminating tools used by The Gentlemen RaaS. It comes in eight variants, each mimicking a different legitimate…
CERT/CC Advisory on UEFI Secure Boot Bypass via BYOVD
CERT/CC issued an advisory about multiple vendor-signed UEFI applications vulnerable to Secure Boot bypass via BYOVD attacks, impacting several hardware vendors.