Fortinet

The Interlock ransomware group deployed a custom evasion tool called Hotta Killer that exploits a zero-day vulnerability (CVE-2025-61155) in a gaming anti-cheat driver to terminate endpoint security processes. The tool uses a BYOVD technique to gain kernel-level access and disable EDR and AV before encrypting systems. This incident highlights a novel attack chain combining...