DeadLock Ransomware Uses BYOVD to Evade Security Measures

A Cisco Talos analysis describes a financially motivated campaign deploying DeadLock ransomware that leveraged a vulnerable Baidu Antivirus driver (CVE-2024-51324) via a BYOVD loader to kill security processes, escalate privileges, remove recovery options, and enable lateral movement; the C++ payload used process hollowing, a custom stream cipher to append ".dlock" to encrypted files, and communicated with victims via Session Messenger while demanding payment in Bitcoin or Monero.