Source: Huntress Blog
Author: unknown
URL: https://www.huntress.com/blog/encase-byovd-edr-killer
ONE SENTENCE SUMMARY:
In February 2026, hackers exploited SonicWall VPN credentials and a revoked EnCase driver to disable security, evading detection.
MAIN POINTS:
- Attackers used compromised SonicWall VPN credentials for initial network access.
- A revoked Guidance Software forensic driver was abused to disable security processes.
- Windows still loads expired certificates, revealing a gap in Driver Signature Enforcement.
- Huntress detected and disrupted the attack before ransomware deployment.
- Analysis involved SonicWall telemetry and VPN authentication logs.
- EDR killer masquerades as a firmware update utility using a wordlist encoding scheme.
- Attack bypassed security by using a kernel-mode driver with IOCTL interface.
- The compromised driver allows process termination from kernel mode.
- Microsoft’s Vulnerable Driver Blocklist is reactive, not preventative.
- Recommendations include enabling MFA, HVCI, and adopting Microsoft’s driver block rules.
TAKEAWAYS:
- BYOVD attacks are increasingly common for bypassing security measures.
- Expired and revoked certificates still pose significant security risks.
- Precise monitoring of VPN logs can help detect suspicious activities.
- Proactive security measures like MFA are crucial to prevent initial access.
- Continuous updates and vigilance are needed to address vulnerabilities promptly.