JEDI-SEC | Security Research & Digital Defense

Tag: ransomware

  • Ransomware gang talked AI agents into doing much of its dirty work

    The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos. AI-assisted intrusion workflow (Source: Sophos) The company, which tracks the group as GOLD OGRE, recovered artifacts from the Cursor AI coding assistant in late August that show the attackers handing the agents VPN logins, proxy access, targets and objectives. The agents then mapped the network … More →

    Source: Help Net Security · 2026-11-02

  • Fake IT help desk callers got by on little more than names and email addresses

    Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. They knew names and email addresses “The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities … More →

    Source: Help Net Security · 2026-10-30

  • UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibility

    John Rupolo reports: University of New Mexico Health is addressing concerns after a cyberattack on Monday, with reports surfacing this week that a ransomware group claimed responsibility for the incident. “So what I can say is we’re also aware of those claims by that group,” said Chris Ramirez, communications director for UNMH. The community’s top…

    Source: DataBreaches.net · 2026-10-29

  • DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security

    Table Of Contents
    Table of Contents
    DefenderKiller Exploits a Legacy Microsoft Driver
    Implications for Endpoint Security
    Indicators of Compromise and Technical Artifacts
    Stay Ahead of EDR Evasion Techniques With Flashpoint

    More

    subscribe to our newsletter

    The abuse of legitimate, vulnerable drivers remains a persistent method of evading endpoint security controls. As EDR killer techniques become publicly available, researchers and threat actors alike are examining how weaknesses in driver access controls can be exploited to terminate protected security processes.

    An older Microsoft Defender driver, dating back to 2011, can still be loaded on the latest version of Windows 11 and abused to terminate security software. The technique, publicly demonstrated through an open-source proof of concept (POC) called DefenderKiller, exploits weaknesses in how the driver restricts access to its process termination functionality.

    Flashpoint analysts have identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated variants that indicate modifications to the original POC.

    DefenderKiller Exploits a Legacy Microsoft Driver

    On June 29, 2026, security researcher Jehad Abudagga, also known as redteamfortress, published research demonstrating how an older Microsoft driver could be abused to terminate security software. The researcher subsequently released the DefenderKiller POC on GitHub. The technique targets KSLDriver.sys, version 1.1.0013.0, a driver associated with Microsoft’s malware protection infrastructure. Although its digital signature dates to 2011, the driver remains accepted by Windows’ driver verification mechanisms and can load into the kernel on the latest version of Windows 11.

    KSLDriver includes access controls intended to restrict which processes can communicate with it. When loaded, the driver retrieves an AllowedProcessName value from its service registry configuration and applies restrictions limiting access to SYSTEM and administrator accounts. When a user-mode process attempts to communicate with the driver, its process image path is compared against the configured registry value. If the values match, the driver accepts input/output control (IOCTL) requests.

    DefenderKiller exploits this mechanism by configuring the driver’s service and authorized process path before starting the driver. Once authorized, the requesting process can invoke functionality that accepts a target process identifier (PID), obtains the corresponding kernel process object, and terminates the process using ZwTerminateProcess(). This allows a sufficiently privileged attacker to leverage the legitimate driver to terminate security processes.

    Source code of the user-mode application performing the registry bypass before starting the driver. (Source: Flashpoint)

    Following publication of the original POC, Flashpoint analysts identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated versions. These findings indicate that the original code has been modified, although the available evidence does not establish whether the samples have been deployed in confirmed intrusions.

    Implications for Endpoint Security

    The findings illustrate how Bring Your Own Vulnerable Driver (BYOVD) techniques can exploit legitimate, digitally signed drivers to interfere with endpoint security. KSLDriver relies on process authorization checks that can be bypassed through manipulation of registry-controlled information, while remaining loadable on the latest version of Windows 11.

    Flashpoint analysts assess that advances in large language models may be contributing to growing interest in BYOVD research and EDR killer development by making user-mode and kernel-mode code development more accessible. Exploitation generally requires administrative privileges to create the services necessary to load these drivers, although attackers may obtain these privileges through local privilege escalation.

    Security teams should consider monitoring for unexpected kernel driver installations, changes to driver service configurations, and termination of security processes following driver loading. In particular, modifications to registry values such as AllowedProcessName and ImagePath may provide useful investigative context when correlated with suspicious service creation or driver activity.

    Indicators of Compromise and Technical Artifacts

    The following artifacts were identified during Flashpoint’s analysis and may support threat hunting and further investigation.

    Artifact Value
    DefenderKiller service DefenderKiller
    DefenderKiller service registry key HKLM\SYSTEM\CurrentControlSet\Services\DefenderKiller
    Microsoft driver KSLDriver.sys (1.1.0013.0)
    Microsoft driver SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645

    The presence of these artifacts should be evaluated in context, as legitimate software may use some of these components.

    Stay Ahead of EDR Evasion Techniques With Flashpoint

    The discovery of vulnerable drivers beyond those targeted by publicly available EDR killers highlights the need for continued research into the techniques used to disable endpoint defenses. The public release of DefenderKiller, along with the emergence of modified variants, highlights the need for continued visibility into defense evasion techniques and the vulnerable drivers that enable them.

    Flashpoint continuously monitors emerging threats and adversary techniques, combining primary source intelligence with technical research to help organizations understand how threats are evolving. Request a demo to learn how Flashpoint can help your team identify emerging threats and strengthen its defenses.

    See Flashpoint in Action

    Get a Demo

    Contact Sales

    Source: Flashpoint · 2026-10-29

  • BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center

    Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico’s Health Sciences Center (HSC) this week.

    Read more in my article on the Fortra blog.

    Source: Graham Cluley · 2026-10-29

  • Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months

    Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas.

    Source: HackRead · 2026-10-29

  • Officials seize domain of top bulletproof hosting provider Virtualine

    Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

    Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

    The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

    Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

    A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

    “Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

    “Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

    Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

    The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

    Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

    TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

    Source: CyberScoop · 2026-10-29

  • Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems

    A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison.

    Read more in my article on the Hot for Security blog.

    Source: Graham Cluley · 2026-10-28

  • Ransomware in the Age of AI: How Defenders Can Break the Attack Chain

    Table Of Contents
    Table of Contents
    Introducing Ransomware in the Age of AI: A Survival Guide for Defenders
    Understanding the Modern Ransomware Attack Lifecycle
    Build a More Proactive Defense Against Ransomware

    More

    subscribe to our newsletter

    Ransomware operators are scaling their attacks, and the barriers to entry continue to fall. In the first half of 2026, Flashpoint identified 6,256 ransomware attacks across industries, representing a 45% increase between 2025 and 2026, as Ransomware-as-a-Service (RaaS) operations expanded and threat actors increasingly leveraged AI, stolen credentials, and vulnerability exploits to accelerate their campaigns.

    The impact is widespread. Manufacturing accounted for 18% of observed attacks, followed by business services and consulting (13%) and healthcare (9%). Meanwhile, prolific ransomware groups such as Qilin and Akira continue to demonstrate the scale at which these operations can function.

    Understanding how ransomware attacks develop, and where they can be interrupted, is critical for defenders.

    Introducing Ransomware in the Age of AI: A Survival Guide for Defenders

    Flashpoint’s new guide, Ransomware in the Age of AI: A Survival Guide for Defenders, provides cyber threat intelligence professionals, threat hunters, and security leaders with a practical look at the modern ransomware attack lifecycle, from initial reconnaissance and access to incident response and recovery.

    Drawing on Flashpoint’s primary-source intelligence and analysis of evolving threat actor tactics, the guide explores how organizations can identify opportunities to disrupt attacks before they escalate, strengthen incident response, and reduce the risk of repeat compromise.

    Access the guide to learn:

    • How modern ransomware attacks unfold: Follow the attack lifecycle, from reconnaissance, phishing, and initial access through lateral movement, encryption, and ransom negotiations.
    • Where defenders can intervene: Understand how compromised credential monitoring, vulnerability intelligence, and visibility into underground activity can help identify threats before attackers reach critical systems.
    • How AI is reshaping ransomware operations: Explore how AI-enabled capabilities, commoditized tooling, and RaaS ecosystems are changing the economics and execution of ransomware attacks.
    • How to strengthen response and recovery: Learn strategies for containing active incidents, restoring operations, improving cross-team coordination, and reducing exposure to repeat attacks.

    “In H1 2026, Flashpoint observed a 45% surge in ransomware activity, with critical sectors like manufacturing, business consulting, and healthcare taking the brunt of these attacks. As RaaS syndicates like Qilin and Akira scale their operations alongside a 27% rise in infostealers, access is becoming faster and cheaper. Effective defense requires grounding incident response in primary-source intelligence across every phase of the attack lifecycle.”

    Ian GrayVP of Intelligence, Flashpoint

    Understanding the Modern Ransomware Attack Lifecycle

    Ransomware attacks rarely begin with encryption. Long before systems are locked or ransom demands appear, threat actors may be gathering intelligence on potential targets, exploiting exposed vulnerabilities, or acquiring stolen credentials through underground marketplaces.

    Flashpoint observed a 27% increase in infostealer operations in H1 2026 compared to H1 2025, underscoring the growing role of compromised identities in the ransomware ecosystem. Stolen credentials and session data can provide attackers with access to organizational environments, potentially allowing them to bypass traditional defenses and establish a foothold.

    These initial access methods are increasingly interconnected with broader criminal operations. RaaS groups can leverage specialized tools and services throughout the attack chain, while AI-enabled capabilities offer additional opportunities to automate and accelerate certain activities.

    This creates multiple opportunities for defenders to act. Intelligence about exposed credentials, emerging exploitation activity, and threat actor behavior can help security teams identify risks earlier and prioritize defensive action before an intrusion progresses.

    The guide examines these opportunities across the ransomware lifecycle, outlining how proactive intelligence and coordinated response can help organizations minimize operational disruption and strengthen resilience.

    Build a More Proactive Defense Against Ransomware

    As ransomware operations continue to evolve, organizations need visibility into the threats targeting their environments and the intelligence to respond at every stage of an attack.

    From identifying compromised credentials and monitoring emerging threats to containing incidents and preventing repeat attacks, a lifecycle-based approach helps security teams make more informed decisions before, during, and after a ransomware incident.

    Get the Ransomware in the Age of AI: A Survival Guide for Defenders to explore the modern ransomware attack lifecycle and learn how Flashpoint’s threat intelligence can help your organization anticipate, disrupt, and recover from ransomware attacks.

    See Flashpoint in Action

    Get a Demo

    Contact Sales

    Source: Flashpoint · 2026-10-27

  • Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death

    A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.

    Read more in my article on the Hot for Security blog.

    Source: Graham Cluley · 2026-10-20