Cybersecurity articles tagged #BYOVD on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkitshttps://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkitsChinese-speaking actor UAT-10147 deploys SPECTRE, a cross-platform implant featuring Linux rootkit and BYOVD EDR bypass capabilities.Thu, 20 Aug 2026 16:27:35 GMTMalwareLinux RootkitBYOVDUAT 10147SPECTREhttps://runtimerebel.com/blog/goddamn-ransomware-leverages-signed-driver-to-disable-edrhttps://runtimerebel.com/blog/goddamn-ransomware-leverages-signed-driver-to-disable-edrAnalysis of GodDamn ransomware's BYOVD technique, utilizing a Microsoft co-signed driver to disable security software, impacting US companies.Thu, 09 Jul 2026 11:03:47 GMTGodDamn RansomwareBYOVDKernel DriverEDR EvasionMicrosoft Signed DriverRansomwarehttps://runtimerebel.com/blog/cve-2025-5777-anubis-ransomware-exploits-citrix-bleed-2https://runtimerebel.com/blog/cve-2025-5777-anubis-ransomware-exploits-citrix-bleed-2Anubis ransomware affiliates exploit Citrix Bleed 2 (CVE-2025-5777) and BYOVD techniques to breach networks via RMM tools and supply chain credentials.Fri, 03 Jul 2026 07:24:55 GMTCVE-2025-5777Anubis RansomwareCitrix NetScalerBYOVDRMM Abusehttps://runtimerebel.com/blog/bypassing-hardware-gates-exploitability-of-vulnerable-drivershttps://runtimerebel.com/blog/bypassing-hardware-gates-exploitability-of-vulnerable-driversTechnical analysis of how researchers bypass hardware-gating to exploit Windows kernel-mode drivers without physical devices in BYOVD attacks.Fri, 22 May 2026 12:59:07 GMTBYOVDWindows KernelDriver SecurityPrivilege EscalationKernel Exploitationhttps://runtimerebel.com/blog/combatting-edr-killer-tools-and-byovd-attack-techniqueshttps://runtimerebel.com/blog/combatting-edr-killer-tools-and-byovd-attack-techniquesDefenders face new challenges as the EDR-killer ecosystem expands, utilizing Bring Your Own Vulnerable Driver (BYOVD) to disable security agents.Wed, 15 Apr 2026 00:46:31 GMTBYOVDEDR KillerKernel SecurityEndpoint ProtectionDriver Exploitationhttps://runtimerebel.com/blog/qilin-and-warlock-ransomware-bypass-300-edr-tools-via-byovdhttps://runtimerebel.com/blog/qilin-and-warlock-ransomware-bypass-300-edr-tools-via-byovdThreat actors Qilin and Warlock use Bring Your Own Vulnerable Driver (BYOVD) tactics and msimg32.dll to disable security software on compromised endpoints.Mon, 06 Apr 2026 12:23:52 GMTQilinWarlockBYOVDEDR BypassRansomwarehttps://runtimerebel.com/blog/tax-search-malvertising-deploys-hwaudkiller-to-blind-edr-solutionshttps://runtimerebel.com/blog/tax-search-malvertising-deploys-hwaudkiller-to-blind-edr-solutionsU.S. taxpayers targeted by malvertising campaign delivering ScreenConnect and HwAudKiller to disable security software via vulnerable Huawei drivers.Tue, 24 Mar 2026 20:18:52 GMTMalvertisingHwAudKillerScreenconnectBYOVDGoogle Adshttps://runtimerebel.com/blog/54-edr-killers-use-byovd-to-abuse-34-signed-drivershttps://runtimerebel.com/blog/54-edr-killers-use-byovd-to-abuse-34-signed-driversAnalysis reveals 54 EDR killer programs abusing 34 signed drivers via BYOVD to neutralize security before ransomware deployment.Thu, 19 Mar 2026 20:15:35 GMTBYOVDEDR KillerRansomwareKernel ExploitationWindows Securityhttps://runtimerebel.com/blog/warlock-ransomware-byovd-techniques-and-post-exploitation-analysishttps://runtimerebel.com/blog/warlock-ransomware-byovd-techniques-and-post-exploitation-analysisThe Warlock ransomware group has evolved its tactics, utilizing BYOVD techniques and stealthy cross-network activity to bypass EDR and security controls.Tue, 17 Mar 2026 16:31:42 GMTWarlock RansomwareBYOVDEDR EvasionLateral MovementPost Exploitationhttps://runtimerebel.com/blog/russian-speaking-actor-uses-blacksanta-edr-killer-against-hr-teamshttps://runtimerebel.com/blog/russian-speaking-actor-uses-blacksanta-edr-killer-against-hr-teamsRussian-speaking actors use BlackSanta malware to target HR departments, employing BYOVD techniques to disable EDR and facilitate network compromise.Wed, 11 Mar 2026 00:32:05 GMTBlackSantaEDR KillerBYOVDHR TargetingRussian Speaking Actorhttps://runtimerebel.com/blog/byovd-driven-xmrig-campaign-employs-time-based-logic-bombs-and-lateral-movementhttps://runtimerebel.com/blog/byovd-driven-xmrig-campaign-employs-time-based-logic-bombs-and-lateral-movementAn analysis of a sophisticated cryptojacking operation utilizing Bring Your Own Vulnerable Driver (BYOVD) techniques and wormable components to maximize Monero mining…Mon, 23 Feb 2026 20:18:27 GMTXMRigBYOVDCryptojackingPersistenceWormable