Ransomware gang deploys new malware to kill security software

RansomHub ransomware operators are using a new Bring Your Own Vulnerable Driver (BYOVD) malware, named EDRKillShifter by Sophos, to deploy a legitimate but vulnerable driver that disables EDR, elevates privileges, and enables full system control; observed during a May 2024 ransomware investigation, this technique is increasingly popular among both financially motivated gangs and state-backed groups.