Medusa Ransomware Leverages Signed Malicious Driver to Bypass EPP/EDR

Researchers observed the Medusa RaaS operation deploying a revoked, signed malicious driver called ABYSSWORKER (smuol.sys) via a HeartCrypt-packed loader to perform BYOVD attacks that remove EDR notification callbacks and blind security products; multiple samples signed with likely stolen certificates were found on VirusTotal (Aug 2024–Feb 2025). The report also notes exploitation of a vulnerable ZoneAlarm kernel driver to gain elevated privileges and persistent RDP access; recommended mitigations include updating drivers, restricting administrative installs, and detecting BYOVD behaviors.