A year ago, "EDR killer" was a phrase we mostly saw in incident-response retrospectives. It is now a standard component of a ransomware intrusion. ESET's March 2026 report traced almost 90 EDR killer tools in active use, and 54 of them lean on the same trick: Bring Your Own Vulnerable Driver (BYOVD), collectively abusing 35 distinct vulnerable drivers.
A BYOVD (Bring Your Own Vulnerable Driver) attack is a technique where an attacker with local administrator access loads a legitimate, digitally signed driver that contains known security flaws onto a target system. They then exploit those flaws to execute code at the kernel level (Ring 0), allowing them to disable endpoint detection and response (EDR) agents or antivirus software before deploying ransomware or other payloads.
Gentlemen, among the most active ransomware groups of Q1 2026, supplies affiliates with a centralised EDR-killing suite.
This group built an in-house framework called GentleKiller with eight variants, each impersonating a different legitimate security product and using a different vulnerable or malicious driver. One variant, G11, uses PoisonX—a driver that appears to have been signed by Microsoft itself. GentleKiller targets 400 EDR processes from 48 different vendors including Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto Networks, ESET, Bitdefender, Kaspersky and Trellix. The Gentlemen also operationalizes newly disclosed BYOVD proof-of-concepts within days of public release.
Cato CTRL's July 2026 research shows Silver Fox (also tracked via its ValleyRAT/Winos 4.0 implant) moving beyond single-driver BYOVD into a reusable framework that can swap between three signed-but-vulnerable drivers: BootRepair.sys, EnPortv.sys (notably from EnCase forensic software, the same vendor lineage flagged separately by Huntress in February 2026), and wsftprm.sys (CVE-2023-52271) — so the operation survives if any single driver gets blocklisted.
In February 2026, Reynolds ransomware emerged as a new ransomware family with a vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947) embedded directly inside the ransomware payload itself, not dropped as a separate tool. Upon execution, it dropped the driver as C:\ProgramData\402.sys, loaded it, and used it to terminate processes from CrowdStrike Falcon, Palo Alto Cortex XDR, Sophos, Symantec, and Avast before encryption began.
In mid-2026, Symantec's Threat Hunter Team spotted a new ransomware family called GodDamn (assessed to be a rebrand of Beast ransomware) deploying a driver called PoisonX (g11.sys). The attackers used it alongside a user-mode evasion tool disguised as a Symantec product to disable endpoint defenses. In one intrusion, they blinded defenses across at least ten hosts inside a single organization within two days, harvesting credentials with NirSoft tools, deploying AnyDesk for remote access, and clearing the way for encryption.
Qilin deployed a multi-stage BYOVD chain via DLL side-loading. The chain loaded two vulnerable drivers: rwdrv.sys (a renamed ThrottleStop driver) and hlpdrv.sys to gain physical memory access, unregister EDR kernel callbacks, and terminate over 300 EDR drivers across virtually every major security vendor. The same driver combo was also observed in Akira and Makop intrusions.
In December 2025, Cisco Talos documented a DeadLock ransomware campaign using a BYOVD loader against a vulnerable Baidu Antivirus driver to terminate EDR processes, disable Windows Defender entirely, stop services, and impair recovery mechanisms.
Microsoft's answer to BYOVD is the Vulnerable Driver Blocklist, they deny known-bad drivers by Authenticode hash, file name and version, and signer certificate. It's a genuinely useful control. It's also, on its own, not enough, and the last few years have shown ways attackers get past it.
CheckPoint found attackers created over 2,500 distinct variants of the TrueSight.sys (version 2.0.2) driver by tweaking just 8 bytes in the PE header. Each variant has a completely unique hash. Each one carries a still-valid Microsoft digital signature. And because the blocklist works largely on hashes and known signatures, every single one of those 2,500 variants sails right past it.
In February 2026, Huntress documented an intrusion where a EnPortv.sys driver loaded successfully despite its certificate being expired and explicitly revoked. This works because of a real gap in Driver Signature Enforcement: at load time, the kernel only checks that a signature is cryptographically valid and chains to a trusted root, in this case up through VeriSign's old Class 3 Code Signing CA to the Microsoft Code Verification Root that Windows still trusts for kernel-mode signing. In the case Huntress investigated, the driver's certificate was issued in December 2006 and expired in January 2010, well before it was later revoked, but the driver carried a trusted timestamp from before that expiry, so Windows treats the signature as valid indefinitely. Because the certificate predates a July 2015 cutoff, it also qualifies for a legacy exception that still lets older, cross-signed drivers load for backward compatibility.