Attackers Exploit Vulnerable Windows Driver to Disable EDR Tools

In early February 2026, attackers exploited a decade-old vulnerability in a Guidance Software EnCase kernel driver to disable endpoint detection and response (EDR) tools during a network intrusion. They gained access through compromised SonicWall SSLVPN credentials and used the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate security processes. The attack was halted before ransomware could be deployed.