Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
RansomHub Ransacks Systems: How Cybercriminals Abuse Kaspersky’s TDSSKiller to Disable Defenses
RansomHub gang exploits Kaspersky’s TDSSKiller to disable endpoint detection and response services, paving the way for LaZagne credential harvesting. It’s like using a Swiss Army knife to break into a vault—unexpected and surprisingly effective.
Hot Take:
Who knew a superhero tool could turn supervillain? Looks like TDSSKiller is having a mid-life crisis and switching sides! RansomHub, the ransomware gang, is like that kid in high school who figured out how to hack the vending machine.
Key Points:
- RansomHub is using Kaspersky’s TDSSKiller to disable endpoint detection and response (EDR) services.
- After disabling defenses, RansomHub deploys LaZagne to harvest credentials.
- TDSSKiller was designed to detect rootkits and bootkits but is being abused to interact with kernel-level services.
- The legitimate tool was executed from a temporary directory with a dynamically generated filename.
- Detecting LaZagne is easy, but preventing TDSSKiller from disabling security is crucial.
Already a member? Log in here