New BYOVD loader behind Dead Lock ransomware attack
Summary: Cisco Talos observed a threat actor using a bring-your-own-vulnerable-driver technique with the legitimate Baidu Antivirus driver BdApiUtil.sys, renamed DriverGay.sys, to exploit CVE-2024-51324 and terminate security processes at the kernel level via IOCTL 0x800024b4 before delivering DeadLock ransomware. Talos found the actor had access to the victim network five days before encryption, enabling RDP through registry and firewall changes, installing AnyDesk for persistent access, and disabling Windows Defender before the payload ran.
Bottom line: A signed antivirus driver already on endpoints was enough to kill the security stack at kernel level, and the actor had five days inside the network before encryption began.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-51324
- Related
- One newsletter to rule them all Cyber Risks ·University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026