Latest news with #GuidepointSecurity
Epoch Times
3 days ago
- Business
- Epoch Times
Is Your Data Held Hostage? There's a Ransomware Negotiator for That
Mark Lance, a ransomware negotiator with Guidepoint Security, said early intervention is key in cyberattacks, as it helps manage expectations and outline options for victims. Courtesy of Guidepoint Security By Chris Summers August 10, 2025 Updated: August 10, 2025 Mark Lance's phone rings when a company's data is being held hostage. Often, the perpetrators are demanding a ransom to return sensitive information. 'The largest demand for one of our victims was $70 million,' said Lance, a ransomware negotiator with Virginia-based Guidepoint Security.
Tom's Guide
6 days ago
- Tom's Guide
Hackers are abusing this Intel tool to disable Windows 11's built-in antivirus — don't fall for this
The Akira ransomware, which has been surging in popularity lately, has also been used recently by hackers in conjunction with a legitimate Intel CPU tuning driver to disable Microsoft Defender. As reported by Bleeping Computer, the attacks are registering the driver as a service in order to gain kernel-level access. The Intel CPU driver that is being abused is (used by ThrottleStop), and is likely used to load a secondary driver ( That secondary driver is a malicious tool that causes Microsoft Defender to turn off protections. These types of attacks are often referred to as BYOVD 'Bring Your Own Vulnerable Driver,' as they're used when threat actors already have a legitimate signed driver with known weaknesses that can be exploited to achieve privilege escalation. They are then, as is the case with the above drivers, used to load malicious tools or disable antivirus software. Researchers at Guidepoint Security, who reported seeing the malicious behavior, stated that when the second driver is executed it modifies the DisableAntiSpyware settings of Microsoft Defender within the Registry. The malware does this via the execution of The researchers at Guidepoint Security have provided a YARA rule, complete indicators of compromise (IoCs), service names and file paths to help defend against and block these attacks. Additionally, they recommend having system administrations monitor for Akira-related activity, apply filters and blocks as indicators emerge – and make sure to only download software from official sites and trusted sources as malicious sites and mimicked sources have become a more and more common way to distribute such malware. It's always alarming when hackers figure out way out ways to abuse legitimate security tools in their attacks but fortunately, this attempt was spotted quickly and a fix was devised early enough before this campaign could do significant damage. Get instant access to breaking news, the hottest reviews, great deals and helpful tips. Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
