One newsletter to rule them all
Summary: Cisco Talos reported new tactics, techniques, and procedures tied to a financially motivated actor using DeadLock ransomware, which encrypts Windows files with a custom stream cipher that uses time-based cryptographic keys. The actor used the Bring Your Own Vulnerable Driver technique with a previously unknown loader to exploit the Baidu Antivirus driver vulnerability CVE-2024-51324 and terminate endpoint detection and response processes.
Why it matters: The campaign is built to make recovery harder: a previously unknown loader disables EDR through a known Baidu Antivirus driver flaw, and time-based keys plus selective targeting complicate decryption for enterprise victims.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2024-51324
- Related
- New BYOVD loader behind Dead Lock ransomware attack Cyber Risks ·ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026