DeadLock Ransomware Uses New BYOVD Method to Disable EDR

Cisco Talos has revealed that a financially motivated threat actor deploying DeadLock ransomware has adopted a sophisticated Bring Your Own Vulnerable Driver (BYOVD) tactic to bypass and disable endpoint detection and response (EDR) mechanisms.

This discovery highlights an alarming evolution in ransomware techniques aimed at undermining enterprise defenses and complicating recovery efforts.

The driver operates in kernel mode with the highest system privileges, it blindly accepts the command and executes ZwTerminateProcess(), instantly killing the targeted security service. 

The attacker exploited a previously unknown vulnerability (CVE-2024-51324) in a legitimate Baidu Antivirus driver (BdApiUtil.sys), repurposing it under the guise of “DriverGay.sys.”

This Improper Privilege Management flaw allows unprivileged users to terminate any system process at kernel level.

By deploying a custom loader (“EDRGay.exe”) alongside this vulnerable driver into a victim’s system, the adversary connects to the driver using Windows API calls and issues commands to kill security and antivirus services.

This effectively neutralizes EDR tools before ransomware execution.
Following the disabling of defenses, the actor runs a PowerShell script that bypasses User Account Control (UAC) to gain elevated privileges.

The script then disables Windows Defender, terminates critical security, backup, and database services, and deletes all volume shadow copies.

Removing these shadow copies ensures system recovery options are eliminated, increasing the likelihood that victims will pay the ransom.

DeadLock Ransomware

DeadLock ransomware targets Windows systems using a proprietary stream cipher encryption algorithm driven by time-based cryptographic keys.

This careful design enables it to encrypt a wide range of files standard in enterprise environments selectively, avoiding system corruption and employing anti-forensics measures that frustrate recovery attempts.

The DeadLock ransomware relies on a massive 8,888-byte configuration block embedded directly within its binary to dictate its entire operational strategy.

Talos further observed that the attacker gains initial access by compromising valid accounts, often enabling Remote Desktop Protocol (RDP) and firewall exceptions to maintain remote persistence.

They also deploy AnyDesk silently to secure long-term access. After infiltration, the actor conducts internal reconnaissance using system commands to identify high-value targets and moves laterally using RDP sessions and management consoles.

Before the ransomware encrypts files, it drops a batch loader script that sets the console’s code page to UTF-8 for proper ransom note display, then executes the ransomware binary.

The ransomware injects itself into rundll32.exe to masquerade as a legitimate process and begins multi-threaded encryption, excluding critical system files and paths from its destructive operations to maintain system stability for ransom negotiations.

Besides killing EDR and security tools, DeadLock also disables various business-critical applications and backup services, including Microsoft SQL Server, Veeam, and Symantec Endpoint Protection, ensuring encryption proceeds without interference.

Encrypt entire file systems while avoiding detections through custom cryptographic implementations rather than standard Windows cryptographic APIs.  

The ransomware leaves a ransom note claiming “military-grade encryption” and instructs victims to use Session messenger for confidential communication with the attackers.

This encrypted messaging platform provides anonymity and evasion from law enforcement monitoring.

BYOVD Technique Powers

Cisco Talos recommends multiple layers of defense to combat this threat, including Cisco Secure Endpoint to block malware execution, Secure Email to filter phishing campaigns propagating DeadLock, and Secure Firewall to detect malicious traffic.

Additional protections involve network analytics, malware sandboxing, and zero-trust access solutions to prevent lateral movement.

After encryption, the actor also changed the victim machine’s desktop wallpaper to a custom wallpaper and disabled the command line utilities in the victim machine.  

Snort rules and ClamAV detections are also available to detect components of this attack, providing actionable tools for defenders.

The rise of DeadLock ransomware utilizing the BYOVD technique illustrates how attackers are innovating with kernel-level vulnerabilities to disable security tools preemptively.

Organizations must remain vigilant by applying patches promptly, monitoring for abnormal process terminations, and employing robust endpoint security layers to mitigate these emerging threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.