Breach Record

Sophos

DISCLOSED 2024-01-20 · MALWARE

A threat actor named Spyboy is selling a tool called Terminator that uses the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate processes of endpoint security products. The tool loads a vulnerable Zemana anti-malware driver to execute code in kernel mode, bypassing user-mode protections. SentinelOne detects known samples, and organizations are advised to...

The record

What we know

Disclosed

2024-01-20

Attack vector

Malware

Sources

Cited reporting

↗ www.sentinelone.com (2024-01-20)

Similar vector · recent

Other malware breaches on file

This page is the permanent ColdRecon entry for the Sophos disclosure. It updates if new public reporting emerges. All tracked breaches →

Sophos just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →