VEN0m Ransomware: DFIR Analysis, Detection Engineering & Key Recovery

VEN0m is an open-source Rust ransomware proof-of-concept that combines a legitimately signed but vulnerable IObit kernel driver (CVE-2025-26125) with UAC bypass and AES-256-GCM file encryption; the report documents full attack-chain analysis, test detonations (Windows Defender fully bypassed; a commercial EDR prevented the attack by quarantining the driver in ~127 ms), IOCs, 42 behavioral detections, source-code review, and practical key-recovery and IR procedures (the encryption key is hardcoded in the binary).