Hackers Weaponize 2,500+ Security Tools to Disable Endpoint Defenses Before Ransomware Attacks

Gbhackers •Mayura Kathir • January 21, 2026

A sophisticated campaign has weaponized over 2,500 variants of a legitimate security driver to disable endpoint protection before deploying ransomware and remote access trojans. Attackers are abusing truesight.sys, a kernel-mode driver from Adlice Software’s RogueKiller antivirus suite. The legacy version 2.0.2 contains a critical vulnerability allowing arbitrary process termination via IOCTL command 0x22E044. This enables […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit Security Driver to Disable Endpoint Protection for Ransomware Deployment Hackers have weaponized over 2,500 variants of the truesight.sys security driver from Adlice Software's RogueKiller antivirus to disable endpoint protection mechanisms prior to launching ransomware attacks. This campaign exploits a critical vulnerability in the legacy version 2.0.2, allowing attackers to terminate processes via a specific IOCTL command. 2 sources 55

Hackers Weaponize 2,500+ Security Tools to Disable Endpoint Defenses Before Ransomware Attacks

The full story

Extracted Entities

Attack Types (2)

Tools (2)