The Terminator tool is coming back
BYOVD (Bring Your Own Vulnerable Driver) are still very popular among threat actors as EDR killers. One reason is that this raises the prospect of a kernel-level attack, which gives cybercriminals a wide range of options - from hiding malware to spying on login credentials to attempting to disable EDR solutions. Sophos security specialists Andreas Klopsch and Matt Wixey have closely examined what has been happening with Terminator tools over the last six months and published the report “It'll be back: Attackers still abusing Terminator...