Hackers Weaponized 2,500+ Security Tools to Terminate Endpoint Protection Before Deploying Ransomware

A widespread campaign is abusing the legitimately signed TrueSight kernel driver (truesight.sys) to disable endpoint protection on Windows hosts, using over 2,500 validly signed variants to evade defenses and enable ransomware and remote-access trojan deployments; initial access is via phishing or fake downloads, with staged payload delivery, persistence, and an obfuscated EDR-killer module that installs and invokes the vulnerable driver to terminate security processes, leaving victims blind to encryption or data exfiltration.