A Valid Microsoft Signature Does Not Mean a Driver Is Safe by Lucie Cardiet

**Executive Summary:** The report describes BYOVD campaigns where ransomware operators (tracked as Hackledorb/DragonForce and observed via the GentleKiller framework) loaded legitimate, signed kernel drivers — including one without a CVE at time of attack — to disable security tools, exploiting a timing gap between vulnerability discovery/CVE assignment and Microsoft’s vulnerable-driver blocklist; defenders can detect pre-kill activity by monitoring Event ID 7045 and mitigate structurally via Memory Integrity (HVCI).