Driver of destruction: How a legitimate driver is being used to take down AV processes

This report analyzes an incident in Brazil where attackers used valid RDP credentials and credential theft (Mimikatz) to move laterally and deploy a MedusaLocker ransomware, leveraging a malicious AV-killer (All.exe) that abuses a vulnerable signed driver (ThrottleStop.sys / CVE-2025-7771) to read/write physical memory, hijack kernel functions, and terminate many AV/EDR processes; the document includes technical analysis, IOCs, a YARA rule, TTP mapping, affected regions, and mitigation recommendations.