Week of February 2, 2026

Security researchers discovered a ransomware payload that embeds a Bring Your Own Vulnerable Driver (BYOVD) component directly within the ransomware binary, rather than dropping it as a separate tool. This technique allows the ransomware to disable endpoint security products by exploiting a legitimate but vulnerable driver, increasing stealth and effectiveness.

CVE-2025-13818 is a local privilege escalation vulnerability in ESET Management Agent for Windows caused by a Time-of-Check Time-of-Use (TOCTOU) race condition in temporary batch file handling. A local attacker with high privileges can replace a validated batch file before execution, leading to arbitrary command execution with elevated privileges. ESET has released a patch to address the issue.

Tanium Threat Response contains an information disclosure vulnerability (CVE-2025-15332) where sensitive data is improperly inserted into log files without sanitization. This could expose credentials or system details to users with access to logs. Tanium has addressed the issue, and affected versions include 4.5.0, 4.6.0, and 4.9.0.

The Interlock ransomware group deployed a custom evasion tool called Hotta Killer that exploits a zero-day vulnerability (CVE-2025-61155) in a gaming anti-cheat driver to terminate endpoint security processes. The tool uses a BYOVD technique to gain kernel-level access and disable EDR and AV before encrypting systems. This incident highlights a novel attack chain combining social engineering, lateral movement, and defense evasion targeting education sector organizations.

A new EDR killer named EDRKillShift leverages a legitimate but revoked EnCase kernel driver to terminate processes associated with 59 security tools. The tool uses a BYOVD technique to load the signed driver and then unhooks or disables endpoint detection and response (EDR) and antivirus software. This demonstrates a practical bypass method that remains effective despite the driver's certificate revocation.

A vulnerability in BeyondTrust Privilege Management for Windows allows bypassing its anti-tamper protections. This could enable an attacker to disable or manipulate the security agent, undermining endpoint privilege management controls.