EDR killer tool uses signed kernel driver from forensic software

Huntress investigated an intrusion where attackers used compromised SonicWall VPN credentials (without MFA) to deploy a disguised EDR-killer that leverages an old, revoked EnCase kernel driver (EnPortv.sys) via a BYOVD technique to obtain kernel-level control, terminate 59 security-related processes, establish reboot-persistent OEM-style driver persistence, and perform aggressive internal reconnaissance; the activity is linked to suspected ransomware but was interrupted before the final payload was deployed.