Windows Tools Abused to Kill AV Ahead of Ransomware Attacks

The report details a trend where threat actors weaponize legitimate Windows admin utilities and vulnerable drivers (e.g., Process Explorer driver via BYOVD, AuKill, PowerRun, YDArk) to gain SYSTEM/kernel privileges, terminate antivirus and EDR processes, and create a silent window to deploy ransomware (notably LockBit and MedusaLocker) and credential theft tools like Mimikatz; it warns that RaaS kits and customizable modules lower the bar for affiliates and recommends layered defenses (behavioural detection, self-protection, application control) as mitigations.