Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks

This article examines the growing use of bring-your-own-vulnerable-driver (BYOVD) attacks—where threat actors drop and load signed but vulnerable kernel drivers to obtain ring-0 privileges and kill security products—highlighting real-world abuse (e.g., an EnCase driver weaponized, Black Basta/Reynolds campaigns), shortcomings in Windows driver-signing/backward-compatibility and Microsoft's blocklist cadence, and short- and medium-term mitigation strategies for vendors and defenders.