Hackers Weaponized 2,500+ Security Tools to Terminate Endpoint Protection Before Deploying Ransomware

Cybersecuritynews •Tushar Subhra Dutta • January 21, 2026

A large-scale campaign is turning a trusted Windows security driver into a weapon that shuts down protection tools before ransomware and remote access malware are dropped. The attacks abuse truesight.sys, a kernel driver from Adlice Software’s RogueKiller antivirus, and use more than 2,500 validly signed variants to quietly disable endpoint detection and response (EDR) and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit Security Driver to Disable Endpoint Protection for Ransomware Deployment Hackers have weaponized over 2,500 variants of the truesight.sys security driver from Adlice Software's RogueKiller antivirus to disable endpoint protection mechanisms prior to launching ransomware attacks. This campaign exploits a critical vulnerability in the legacy version 2.0.2, allowing attackers to terminate processes via a specific IOCTL command. 2 sources 55

Extracted Entities

Hackers Weaponized 2,500+ Security Tools to Terminate Endpoint Protection Before Deploying Ransomware

The full story

Extracted Entities

Attack Types (2)

Platforms (1)

Tools (2)