Hackers Exploit Legitimate Drivers to Disable Antivirus and Weaken System Defenses

Threat actors have been deploying a novel antivirus (AV) killer since at least October 2024, leveraging the legitimate ThrottleStop.sys driver to execute Bring Your Own Vulnerable Driver (BYOVD) tactics. This malware, detected by Kaspersky as Win64.KillAV., systematically terminates AV processes, paving the way for ransomware deployment like the MedusaLocker variant (Trojan-Ransom.Win32.PaidMeme.). The incident began with […]

The post Hackers Exploit Legitimate Drivers to Disable Antivirus and Weaken System Defenses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.