Malicious Windows Kernel Drivers Utlized in BlackCat Ransomware Attacks

Researchers have discovered an end-point security evasion mechanism used by the group known as BlackCat. The new technique conceals the gang’s defensive measures when inside a network. The cybercrime group was discovered employing signed Microsoft kernel drivers to control and terminate security processes installed on protected machines. 

As per the analysis, this is expected to become a standard technique in the arsenal of cybercriminals.

Then, Microsoft revoked multiple Microsoft hardware developer accounts used in these assaults.

BlackCat ransomware’s end-point security evasion mechanism has been discovered. 

Affiliates of BlackCat have been known to employ a variety of defense evasion techniques in order to remain undetected in a system for as long as possible. The most recent method is the use of malicious kernel drivers that have been signed through  Microsoft hardware developer accounts. According to Trend Micro research, this enables to impair defenses on a victimized computer by manipulating, halting, and killing numerous processes on target end-points associated to security agents.