PoorTry Windows driver evolves into a full-featured EDR wiper

The report explains that the PoorTry (BurntCigar) kernel-mode driver—previously used to disable endpoint detection and response (EDR)—has been updated to act as an EDR wiper that deletes critical EXEs/DLLs and other security components to prevent recovery. Used by multiple ransomware groups (e.g., BlackCat, Cuba, LockBit) and observed in a July 2024 RansomHub incident, the tool employs kernel/user-mode components, hardcoded paths and file-type deletion, signing evasion tactics (timestamp manipulation and certificate roulette), and packing/obfuscation to increase success and evade detection.