Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates

from The Hacker News 4 weeks ago

The Medusa ransomware operation utilizes the malicious driver ABYSSWORKER in a sophisticated attack against anti-malware tools. This driver mimics legitimate software, enabling attackers to bypass endpoint detection and response (EDR) systems. The loader used to deploy this ransomware is packed using HeartCrypt and exploits expired certificates from Chinese vendors. The ABYSSWORKER driver is designed to execute numerous commands for system manipulation, effectively neutralizing security measures without raising alerts. As observed, this technique highlights the evolving tactics in cyberattacks.

The driver, 'smuol.sys,' mimics a legitimate CrowdStrike Falcon driver and uses revoked certificates for its operations, bypassing security measures undetected.
The Hacker Newshttps://thehackernews.com/2025/03/medusa-ransomware-uses-malicious-driver.html

ABYSSWORKER allows for a wide array of operations, from file manipulation to process termination, providing a comprehensive toolkit to disable EDR systems.
The Hacker Newshttps://thehackernews.com/2025/03/medusa-ransomware-uses-malicious-driver.html

Read at The Hacker News

#ransomware #cybersecurity #malware #endpoint-protection #threat-intelligence

Collection

[

...

]

Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen CertificatesMedusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates Briefly

Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
Briefly