Hackers Exploit SonicWall SSLVPN Credentials to Deploy EDR Killer and Bypass Security

Threat actors leveraged compromised SonicWall SSLVPN credentials to gain network access and deployed a sophisticated BYOVD-based “EDR killer” that loads a revoked EnCase kernel driver (dropped as C:\ProgramData\OEM\Firmware\OemHwUpd.sys) to terminate and persistently disable endpoint security processes; the report includes IOCs (two source IPs and two SHA-256 hashes), detailed TTPs (custom wordlist encoding, timestomping, IOCTL usage, kill-loop), and persistence mechanisms.