Ransomware Used Microsoft-Signed Malicious Driver to Kill EDR: 10 Hosts Hit Before Encryption - Tech Times

Ransomware EDR killers just leveled up: GodDamn ransomware used PoisonX — a kernel driver bearing a legitimate Microsoft Hardware Compatibility Publisher signature — to terminate security software on...

A ransomware operation that has quietly evolved for four years just achieved something security researchers say they had not seen before: it obtained a legitimately signed Microsoft kernel driver des…