Full Report
Cisco Talos has uncovered a new DeadLock ransomware campaign using a previously unknown BYOVD loader to exploit a Baidu Antivirus driver vulnerability, letting threat actors disable EDR defenses and escalate attacks.
Analysis Summary
# Incident Report: DeadLock Ransomware Campaign Utilizing BYOVD for EDR Evasion
## Executive Summary
Cisco Talos discovered a financially motivated DeadLock ransomware campaign that successfully bypassed Endpoint Detection and Response (EDR) controls through the novel exploitation of a Baidu Antivirus driver vulnerability (CVE-2024-51324) via a Bring Your Own Vulnerable Driver (BYOVD) technique. The attack progressed by first terminating security processes, disabling recovery options via a malicious PowerShell script, and finally deploying the custom stream cipher DeadLock ransomware to encrypt files across Windows enterprise environments.
## Incident Details
- **Discovery Date:** December 9, 2025 (Date of Talos publication describing the threat)
- **Incident Date:** Unknown, tracking ongoing campaign activities.
- **Affected Organization:** Not publicly disclosed (Targeting broad enterprise environments).
- **Sector:** General/Unspecified (Financially motivated targeting enterprises).
- **Geography:** Not specified.
## Timeline of Events
### Initial Access
- **Date/Time:** Undetermined.
- **Vector:** Dropping and executing a custom loader (`EDRGay.exe`).
- **Details:** The threat actor deployed a loader (`EDRGay.exe`) and the vulnerable driver (`DriverGay.sys`, masquerading as the legitimate Baidu driver `BdApiUtil.sys`) into the victim’s Videos folder.
### Lateral Movement
- **Details:** The provided context focuses heavily on privilege escalation and defense evasion rather than traditional lateral movement, suggesting the initial compromise focused on rapid environmental control from the compromised endpoint. Subsequent steps involve rapid encryption deployment.
### Data Exfiltration/Impact
- **Impact:** System encryption using DeadLock ransomware's custom stream cipher, aimed at impacting operational availability and forcing ransom payment. Selective targeting was used to prevent system corruption, complicating recovery.
### Detection & Response
- **How it was discovered:** Cisco Talos tracked the ransomware activities and uncovered the novel TTPs, specifically the BYOVD loader exploiting CVE-2024-51324.
- **Response actions taken:** Talos published details to inform the security community, providing Snort IDs and ClamAV detections.
## Attack Methodology
- **Initial Access:** Execution of a dropped loader in a user-accessible directory (Videos folder).
- **Persistence:** Not explicitly detailed, but typical ransomware operations imply preparation for re-execution.
- **Privilege Escalation:** Achieved via the BYOVD exploit (CVE-2024-51324) using the Baidu driver, allowing kernel-level process termination. The PowerShell script also utilized UAC bypass techniques (`RunAs` parameter) to elevate to administrative privileges.
- **Defense Evasion:** Exploitation of CVE-2024-51324 to kill EDR processes via kernel-level calls. Disabling Windows Defender via the PowerShell script.
- **Credential Access:** Not explicitly detailed for this stage of the attack.
- **Discovery:** Identification of EDR/security PIDs via process enumeration by the loader before exploitation.
- **Lateral Movement:** Not the primary focus of the described stages.
- **Collection:** Not explicitly detailed prior to encryption/impact.
- **Exfiltration:** Not detailed in the provided snippet.
- **Impact:** Deployment of DeadLock ransomware for file encryption using a custom stream cipher, coupled with deletion of all volume shadow copies to inhibit system recovery.
## Impact Assessment
- **Financial:** Undetermined, but significant due to potential ransomware demands and recovery costs.
- **Data Breach:** Files encrypted and potentially rendered inaccessible until decryption.
- **Operational:** High risk of downtime due to service termination (security, database, backup) and system-wide file encryption.
- **Reputational:** Potential impact depending on the confidentiality of encrypted data and operational reliance on affected systems.
## Indicators of Compromise
* **Network Indicators:** None provided (defanged).
* **File Indicators:**
* Loader file name: `EDRGay.exe`
* Vulnerable Driver file name: `DriverGay.sys` (Disguised Baidu Driver: `BdApiUtil.sys`)
* **Behavioral Indicators:**
* Communication with the vulnerable driver via `CreateFile()` targeting `\\.\BdApiUtil`.
* Use of `DeviceIOControl()` with IOCTL `0x800024b4` to trigger kernel-mode termination.
* PowerShell script using UAC bypass (`Verb RunAs` and exec bypass).
* Termination of security, backup, and database services.
* Deletion of volume shadow copies.
## Response Actions
- **Containment:** (Implied) Isolating affected endpoints to prevent further DeadLock propagation.
- **Eradication:** Removal of the loader, the vulnerable driver file, and the malicious PowerShell script components.
- **Recovery:** Restoration of encrypted files from clean backups (if backups were not deleted by the PowerShell script) and verification of full security tool functionality.
## Lessons Learned
- Legacy or third-party drivers, even those considered legitimate (like Baidu Antivirus), can represent critical kernel-level attack surfaces if vulnerable (CVE-2024-51324).
- Attackers are increasingly leveraging the BYOVD technique to surgically disable advanced security countermeasures (EDR) before deploying the final payload.
- The integration of defense evasion (BYOVD) and recovery inhibition (Shadow Copy deletion) into a single preparation phase significantly increases the probability of successful encryption.
## Recommendations
- **Driver Hygiene:** Implement strict auditing, monitoring, and digital signature checks for all loaded kernel drivers. Uninstall or remove all obsolete or unused third-party drivers.
- **Patch Management:** Prioritize remediation efforts for known vulnerabilities, such as CVE-2024-51324, especially in drivers that grant kernel-level access.
- **Security Posture:** Strengthen EDR/AV configuration to monitor and alert on suspicious `DeviceIOControl()` calls or attempts to leverage system driver handles.
- **Script Execution Control:** Implement AppLocker or equivalent controls to restrict the execution of unsigned PowerShell scripts, especially those attempting UAC bypass or service manipulation.
- **Recovery Resilience:** Ensure backups are immutable, segregated, and regularly tested, as shadow copy deletion is a common ransomware preparatory step.