Ransomware Used Microsoft-Signed Driver to Kill EDR

A ransomware operation deployed a Microsoft-signed malicious kernel driver to disable endpoint detection and response (EDR) software on targeted systems. The attack struck 10 hosts before proceeding with file encryption. The driver abused a valid Microsoft signature to bypass security controls and evade detection during the initial phase of the compromise.