Ransomware’s Stealthy Ascent: Microsoft-Signed Driver Bypasses Defenses
GodDamn ransomware now exploits PoisonX, a Microsoft-signed kernel driver, to disable endpoint security, marking a critical escalation in evasion tactics.
Data breaches, ransomware payouts, and phishing operations rarely make the news until the damage is already done. This is where Xploitwire tracks the attackers — who they are, how they got in, and what it means for the organizations and people caught in the blast radius.
GodDamn ransomware now exploits PoisonX, a Microsoft-signed kernel driver, to disable endpoint security, marking a critical escalation in evasion tactics.
Forg365, a sophisticated phishing-as-a-service platform, now combines AI-assisted lure generation with advanced AiTM and device code methods to compromise Microsoft 365 accounts and maintain persistent access.
A sophisticated new group named Helix leverages identity-based phishing and MFA abuse to infiltrate corporate SharePoint environments, exfiltrating sensitive data for extortion or sale.