Ransomware gang deploys new malware to kill security software

Sophos researchers identified EDRKillShifter, a loader used by RansomHub and possibly other actors that deploys legitimate but vulnerable drivers (e.g., RentDrv2, ThreatFireMonitor) in BYOVD attacks to escalate privileges and terminate EDR processes so ransomware can run; researchers found multiple samples, associated proof-of-concept exploits on GitHub, evidence of attempted use in a May incident, and recommend tamper protection, least-privilege separation, and prompt driver/system patching.