EDR Killer Malware Exploits Vulnerable Drivers to Disable Security Tools
In early February 2026, threat actors exploited compromised SonicWall SSLVPN credentials to infiltrate a corporate network. Once inside, they deployed a custom 'EDR killer' malware that utilized a signed but revoked EnCase forensic driver to disable 59 endpoint detection and response (EDR) and antivirus tools. This 'Bring Your Own Vulnerable Driver' (BYOVD) technique allowed attackers to gain kernel-level access, effectively neutralizing security defenses and facilitating further malicious activities. The intrusion was disrupted before ransomware deployment, but it underscores the growing trend of adversaries weaponizing legitimate drivers to bypass endpoint security measures. ([huntress.com](https://www.huntress.com/blog/encase-byovd-edr-killer?utm_source=openai)) This incident highlights the critical need for organizations to enforce multi-factor authentication (MFA) on VPN access, regularly update and monitor security tools, and implement strict controls over driver installations to prevent the exploitation of vulnerable drivers. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/05/edr-killer-vulnerable-encase-driver/?utm_source=openai))
Kill Chain
