Technadu

DeadLock Ransomware Employs BYOVD Technique to Bypass Security

First seen 10 Dec 2025, 18:47 UTC • •50.2

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

DeadLock ransomware is being deployed by a financially motivated threat actor using a new loader that utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique. This method disables endpoint detection and response (EDR) processes by exploiting a known vulnerability in a legitimate Baidu Antivirus driver. The attack involves privilege escalation, registry modifications, and custom encryption routines.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 183d ago How this analysis works

Threat Graph

18 entities, 31 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Ransomware
Bring Your Own Vulnerable Driver
T1021.001 - Remote Desktop Protocol
T1055.012 - Process Hollowing
T1059.001 - PowerShell
T1068 - Exploitation for Privilege Escalation
T1112 - Modify Registry
T1490 - Inhibit System Recovery

Vulnerability (2)

CVE-2024-51324
BYOVD

Malware (1)

DeadLock

Affected Platform (3)

Baidu Antivirus
Windows
Windows Defender

Threat Actor (2)

HelloKitty Ransomware Cartel
Kraken Ransomware Group

Tool (2)

AnyDesk
PowerShell

Relationships

HelloKitty Ransomware Cartel uses DeadLock
Kraken Ransomware Group uses DeadLock
HelloKitty Ransomware Cartel uses AnyDesk
HelloKitty Ransomware Cartel uses PowerShell
Kraken Ransomware Group uses AnyDesk
Kraken Ransomware Group uses PowerShell
HelloKitty Ransomware Cartel uses Ransomware
HelloKitty Ransomware Cartel uses Bring Your Own Vulnerable Driver
HelloKitty Ransomware Cartel uses T1021.001 - Remote Desktop Protocol
HelloKitty Ransomware Cartel uses T1055.012 - Process Hollowing
HelloKitty Ransomware Cartel uses T1059.001 - PowerShell
Kraken Ransomware Group uses Ransomware
Kraken Ransomware Group uses Bring Your Own Vulnerable Driver
Kraken Ransomware Group uses T1021.001 - Remote Desktop Protocol
Kraken Ransomware Group uses T1055.012 - Process Hollowing
Kraken Ransomware Group uses T1059.001 - PowerShell
DeadLock exploits CVE-2024-51324
DeadLock exploits BYOVD
AnyDesk exploits CVE-2024-51324
AnyDesk exploits BYOVD
PowerShell exploits CVE-2024-51324
PowerShell exploits BYOVD
CVE-2024-51324 targets Baidu Antivirus
CVE-2024-51324 targets Windows
CVE-2024-51324 targets Windows Defender
BYOVD targets Baidu Antivirus
BYOVD targets Windows
BYOVD targets Windows Defender
HelloKitty Ransomware Cartel related to T1068 - Exploitation for Privilege Escalation
HelloKitty Ransomware Cartel related to T1112 - Modify Registry
HelloKitty Ransomware Cartel related to T1490 - Inhibit System Recovery

Following this threat?

Track HelloKitty Ransomware Cartel, DeadLock and CVE-2024-51324 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed