Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry

Strategic summary

The EDR-killer trade has become a commercialised, tiered market, and because the same vulnerable driver is used by multiple unrelated ransomware crews, attribution by driver hash groups the suppliers rather than the gangs.