DeadLock Ransomware Employs BYOVD Technique to Bypass Security

Technadu

DeadLock Ransomware Employs BYOVD Technique to Bypass Security

First seen 10 Dec 2025, 18:47 UTC • •50.2

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

DeadLock ransomware is being deployed by a financially motivated threat actor using a new loader that utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique. This method disables endpoint detection and response (EDR) processes by exploiting a known vulnerability in a legitimate Baidu Antivirus driver. The attack involves privilege escalation, registry modifications, and custom encryption routines.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 229d ago How this analysis works

More articles in this cluster (3)

Threat Graph

18 entities, 40 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Bring Your Own Vulnerable Driver
Ransomware
T1021.001 - Remote Desktop Protocol
T1055.012 - Process Hollowing
T1059.001 - PowerShell
T1068 - Exploitation for Privilege Escalation
T1112 - Modify Registry
T1490 - Inhibit System Recovery

Vulnerability (2)

CVE-2024-51324
BYOVD

Affected Platform (3)

Baidu Antivirus
Windows
Windows Defender

Threat Actor (3)

deadlock
HelloKitty Ransomware Cartel
Kraken Ransomware Group

Tool (2)

AnyDesk
PowerShell

Relationships

deadlock uses AnyDesk
deadlock uses PowerShell
HelloKitty Ransomware Cartel uses AnyDesk
HelloKitty Ransomware Cartel uses PowerShell
Kraken Ransomware Group uses AnyDesk
Kraken Ransomware Group uses PowerShell
deadlock uses Bring Your Own Vulnerable Driver
deadlock uses Ransomware
deadlock uses T1021.001 - Remote Desktop Protocol
deadlock uses T1055.012 - Process Hollowing
deadlock uses T1059.001 - PowerShell
HelloKitty Ransomware Cartel uses Bring Your Own Vulnerable Driver
HelloKitty Ransomware Cartel uses Ransomware
HelloKitty Ransomware Cartel uses T1021.001 - Remote Desktop Protocol
HelloKitty Ransomware Cartel uses T1055.012 - Process Hollowing
HelloKitty Ransomware Cartel uses T1059.001 - PowerShell
Kraken Ransomware Group uses Bring Your Own Vulnerable Driver
Kraken Ransomware Group uses Ransomware
Kraken Ransomware Group uses T1021.001 - Remote Desktop Protocol
Kraken Ransomware Group uses T1055.012 - Process Hollowing
Kraken Ransomware Group uses T1059.001 - PowerShell
deadlock exploits CVE-2024-51324
deadlock exploits BYOVD
HelloKitty Ransomware Cartel exploits CVE-2024-51324
HelloKitty Ransomware Cartel exploits BYOVD
Kraken Ransomware Group exploits CVE-2024-51324
Kraken Ransomware Group exploits BYOVD
AnyDesk exploits CVE-2024-51324
AnyDesk exploits BYOVD
PowerShell exploits CVE-2024-51324
PowerShell exploits BYOVD
CVE-2024-51324 targets Baidu Antivirus
CVE-2024-51324 targets Windows
CVE-2024-51324 targets Windows Defender
BYOVD targets Baidu Antivirus
BYOVD targets Windows
BYOVD targets Windows Defender
deadlock related to T1068 - Exploitation for Privilege Escalation
deadlock related to T1112 - Modify Registry
deadlock related to T1490 - Inhibit System Recovery

Following this threat?

Track deadlock and CVE-2024-51324 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…

Microsoft Issues Emergency Patches for Critical Brotli Vulnerability in .NET On October 27, 2026, Microsoft released emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library. This flaw allows unauthenticated remote attackers to execute arbitrary code by sending crafted…