LAS VEGAS — The easiest way around endpoint security may be to stop trying to sneak past it.
Ransomware attackers are increasingly abusing legitimate but vulnerable Windows drivers to reach the Windows kernel, where they can kill or blind antivirus and endpoint detection and response software before launching the ransomware itself, according to Symantec threat researcher Marc Elias.
Elias detailed the technique, known as Bring Your Own Vulnerable Driver, or BYOVD, during a Black Hat USA session on Thursday focused on how attackers weaponize signed drivers against endpoint security. In an interview with Security Point Break following the session, Elias said the tactic is becoming increasingly common as security products get better at detecting the activity that precedes ransomware deployment.
“AVs and EDRs typically are protected processes,” Elias said. By bringing a vulnerable driver onto an already compromised machine, attackers can gain access to capabilities running in kernel space and use the driver to interfere with processes that ordinary malware cannot easily touch. The kernel space runs with operating-system-level privileges, giving attackers access to protected processes that a normal user-mode executable (and many AV/EDR controls watching it) can’t reach.
The mechanics are relatively simple. After gaining administrative access, an attacker drops a legitimate, digitally signed but vulnerable driver onto the machine.
Next, a malicious component then communicates with that driver, often through an input/output control, or IOCTL, request. A poorly secured driver may execute the request without adequately checking who issued it, allowing the attacker to terminate security processes or remove EDR callbacks that feed the product telemetry.
The vulnerable drivers are often older but legitimate, digitally signed software, meaning simply scanning them for malware may not raise an alarm. Attackers bring a known-vulnerable version with them, betting they can exploit it before Windows or endpoint defenses block it.
The technique can also fit neatly into modern ransomware operations. Elias said Symantec has seen BYOVD tools bundled into ransomware-as-a-service offerings, putting the capability into the hands of affiliates. In some attacks, much of the preceding intrusion is conducted using legitimate remote-management software such as AnyDesk and other dual-use or fileless tools. The EDR is disabled only near the end of the chain, clearing the way for ransomware to execute minutes later.
The underlying Lights Out research predates Black Hat. Symantec publicly linked the white paper in a June report examining what it called the growing BYOVD problem, while one of the ransomware examples incorporated into the research, involving Reynolds ransomware, was first published in February. The Black Hat presentation was therefore a deeper examination of the mechanics and defenses rather than an initial disclosure.
Elias said best practices for identifying and defending against BYOVD-based attacks require more than maintaining lists of known vulnerable drivers.
“You have to inspect how the malware interacts with the driver, looking at the behavior,” he said. An attempt to use a driver to kill a protected AV or EDR process is suspicious regardless of which vulnerable driver an attacker happens to bring along.
A lightly edited transcript of Security Point Break’s interview with Marc Elias follows.
SPB Interview: Marc Elias on BYOVD and Ransomware
The following interview has been lightly edited for clarity, grammar and repetition. Obvious transcription errors involving technical terminology have been corrected.
SPB: Welcome to Black Hat 2026 with Security Point Break. I’m here with Broadcom’s Marc Elias, who gave a research talk yesterday on Bring Your Own Vulnerable Driver. Marc, can you introduce yourself?
Marc Elias: Yes. I’m Marc Elias from the Symantec Threat Hunter Team, and I’m mostly focused on tracking nation-state groups and ransomware groups.
SPB: Your talk was on Bring Your Own Vulnerable Driver, a play on Bring Your Own Device. We’re essentially talking about hackers bringing their own driver to the victim’s machine. Can you give us an overview of the research and the presentation?
Marc Elias: Sure. The talk was about Bring Your Own Vulnerable Driver. We focused mostly on ransomware attacks, and we described how attackers use those tools to kill AVs and EDRs, or silence them so they can’t get telemetry.
SPB: How long have you been seeing attackers use drivers to get around or defeat EDR?
Marc Elias: We’ve seen it for quite a long time already, but nowadays we’re seeing it more frequently.
SPB: Why drivers? Why not just bring your own malicious executable? What is unique about the driver that makes it desirable to drop onto a victim’s computer?
Marc Elias: AVs and EDRs typically are protected processes. When attackers bring their own vulnerable driver, they have higher privileges and can interact with the driver, and the driver can kill the AV or EDR.
SPB: Why do you think ransomware groups are increasingly shifting toward driver-based evasion rather than some of the older, more traditional malware techniques?
Marc Elias: We believe products are getting better at detecting ransomware attacks. Nowadays, ransomware groups need those tools to kill the AVs and EDRs, not only their typical executables.
SPB: How are defenders supposed to identify this? If the driver itself is legitimate and the attack is relatively stealthy, what should defenders be looking for?
Marc Elias: That’s one of the approaches we proposed. You have to look at the behavior of the malicious file.
Typically, they drop the driver and then have a malicious file interacting with it. The driver is not malware per se. It’s benign.
So we defined an approach where you inspect how the malware interacts with the driver and look at the behavior. If a sample tries to kill a protected process, an AV or an EDR, that’s how you should detect the attack. You shouldn’t only have a list of vulnerable drivers.
SPB: How are attackers getting that binary onto the victim’s machine?
Marc Elias: To run these Bring Your Own Vulnerable Driver tools, they typically already need access to the machine.
Common tactics for getting the initial infection include exploiting vulnerable infrastructure on the victim’s network or executing a document delivered by email. Nowadays we’re also seeing ClickFix attacks.
What they also use throughout much of the infection chain are dual-use tools and remote administration tools.
SPB: When you say dual-use and administration tools, are we talking about living off the land?
Marc Elias: Exactly. And RMM tools such as AnyDesk and other remote-management tools we see in the wild.
That’s also why, at the defense-evasion stage, they need to kill the EDR. The previous steps are typically performed using dual-use tools or fileless attacks that can be difficult to detect.
SPB: Are you seeing this more with newer ransomware groups, or are established groups also adopting BYOVD?
Marc Elias: A little bit of both.
Some ransomware groups operate using an affiliate model, so it depends somewhat on the affiliate and the tools they use.
With newer groups, we’ve also seen Bring Your Own Vulnerable Driver tools being bundled into ransomware-as-a-service offerings, so affiliates can run the tool themselves.
SPB: Let me make sure I understand the mechanics. A ransomware attacker identifies a vulnerable driver ahead of time and brings that driver onto the victim’s machine. They’re not necessarily scanning the victim for a vulnerable driver that is already there?
Marc Elias: Correct. They bring it. They drop it onto the machine. It’s not that they’re scanning the machine trying to find one.
SPB: And they have some mechanism for instructing that driver what to do? You can’t simply drop the driver and have something happen.
Marc Elias: Right. Typically, they have an instruction that lets them interact with it, and the driver is vulnerable in how it handles that interaction.
SPB: Is the instruction essentially, “Shut down the EDR, shut down the AV”?
Marc Elias: It’s more of a pattern that we described in the talk.
The driver has capabilities that can kill processes from kernel space, but it does not properly verify who is making the request through the IOCTL that calls the driver. That can allow a process to use the driver to kill another process.
SPB: Once they’ve done that, does this tool establish command and control or persistence? Is there some larger stealth infrastructure behind it?
Marc Elias: No. These tools typically just interact with the driver, launch the command and do what they need to do, such as kill the AV or remove EDR callbacks from kernel space.
And that’s it. There doesn’t have to be command-and-control network communication.
SPB: And then the ransomware package executes?
Marc Elias: Yes. It can execute a couple of minutes afterward.
SPB: Marc, thank you very much for joining Security Point Break at Black Hat and breaking down the research.
Marc Elias: Thank you very much as well.
