Kasseika ransomware uses antivirus driver to kill other antiviruses

Kasseika is a newly identified ransomware campaign that uses a signed vulnerable driver (Martini.sys) in BYOVD attacks to disable antivirus, spreads via credential theft and PsExec lateral movement, encrypts files with ChaCha20/RSA, and extorts victims with a 50 BTC ransom demand; Trend Micro published the technical analysis and IoCs.