Back Thehackernews

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Thehackernews •[email protected] (The Hacker News) • April 6, 2026

New 2026 Ponemon research reveals where mature identity programs still fall short and what leading organizations are doing to close the gap.

AI agents need identity, but most teams are still figuring out how to implement it. This session cuts through the noise with a practical, production-ready framework.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin and Warlock Ransomware Exploit Vulnerable Drivers to Compromise EDR Tools Qilin and Warlock ransomware variants have been identified exploiting vulnerable drivers to disable over 300 endpoint detection and response (EDR) tools. This exploitation allows the ransomware to evade detection and significantly increases the risk of successful attacks on organizations. The vulnerabilities leveraged by these ransomware families are critical, impacting a wide range of systems and potentially affecting millions of users. Current investigations are ongoing to assess the full scope of the impact and to develop mitigation strategies. Organizations are urged to review their security measures and update their systems to protect against these threats. The situation remains fluid as cybersecurity teams work to respond to the evolving tactics employed by these ransomware groups. 2 sources 70

Extracted Entities

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (2)