article thumbnail

Kasseika ransomware uses antivirus driver to kill other antiviruses

Bleeping Computer

A recently uncovered ransomware operation named 'Kasseika' has joined the club of threat actors that employs Bring Your Own Vulnerable Driver (BYOVD) tactics to disable antivirus software before encrypting files. [.]

Antivirus 131
article thumbnail

New Cactus ransomware encrypts itself to evade antivirus

Bleeping Computer

A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of "large commercial entities." [.]

Antivirus 134
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Stop Ransomware in its Tracks With CipherTrust Transparent Encryption Ransomware Protection

Thales Cloud Protection & Licensing

Stop Ransomware in its Tracks With CipherTrust Transparent Encryption Ransomware Protection madhav Wed, 04/17/2024 - 05:22 Our last blog Ransomware Attacks: The Constant and Evolving Cybersecurity Threat described the ever dangerous and evolving cybersecurity threat of ransomware. CTE-RWP is behavior-based.

article thumbnail

Giant health insurer struck by ransomware didn't have antivirus protection

Malwarebytes

The Philippine Health Insurance Corporation (PhilHealth), has confirmed that it was unprotected by antivirus software when it was attacked by the Medusa ransomware group in September. EDR can detect an intruder's suspicious activity in advance of them running ransomware, as well as being able to identify the ransomware itself.

article thumbnail

Stop Ransomware in its Tracks With CipherTrust Transparent Encryption Ransomware Protection

Security Boulevard

Stop Ransomware in its Tracks With CipherTrust Transparent Encryption Ransomware Protection madhav Wed, 04/17/2024 - 05:22 Our last blog Ransomware Attacks: The Constant and Evolving Cybersecurity Threat described the ever dangerous and evolving cybersecurity threat of ransomware. CTE-RWP is behavior-based.

article thumbnail

LockFile ransomware uses intermittent encryption to evade detection

CSO Magazine

A new ransomware threat called LockFile has been victimizing enterprises worldwide since July. Key to its success are a few new tricks that make it harder for anti-ransomware solutions to detect it. Learn how recent ransomware attacks define the malware's new age and 5 reasons why the cost of ransomware attacks is rising. |

article thumbnail

Kasseika Ransomware Using BYOVD Trick to Disarms Security Pre-Encryption

The Hacker News

The ransomware group known as Kasseika has become the latest to leverage the Bring Your Own Vulnerable Driver (BYOVD) attack to disarm security-related processes on compromised Windows hosts, joining the likes of other groups like Akira, AvosLocker, BlackByte, and RobbinHood.