Of the roughly 90 documented EDR killers actively used in the wild, 54 rely on the same underlying technique: BYOVD. A legitimately signed but vulnerable kernel driver is loaded and then exploited to gain kernel-level access. From there, attackers can terminate the EDR agent or strip callbacks and ETW (Event Tracing for Windows) providers before any ransomware payload is triggered. It is a documented operational playbook of adversaries targeting enterprise environments right now.
In July 2026, researchers documented the GodDamn ransomware operation which is a rebrand from the Hyadina ransomware-as-a-service group, loading the signed PoisonX driver to terminate security processes and remove user-mode API hooks before deploying its payload. The intrusions ran the full playbook: AnyDesk for remote access, a NirSoft-based credential-harvesting toolkit, and then kernel-level process killing against U.S. healthcare, manufacturing, and education targets.
For security leaders, Bring Your Own Vulnerable Driver has moved beyond something that can be handled with patches. It points to a deeper trust issue at the architectural level, tied to how Windows handles signed kernel drivers and the assumptions built on top of that model. Any meaningful response starts with a clear understanding of what BYOVD does to the controls you rely on.
TL;DR Key Takeaways
- ESET research found that 54 of nearly 90 known EDR killer tools use BYOVD, exploiting 35 distinct vulnerable signed drivers to reach kernel-level access
- BYOVD lets attackers terminate EDR processes, unregister kernel callbacks, and disable telemetry before a ransomware payload ever executes
- Defense-in-depth fails when every layer runs on the same host operating system; a single kernel compromise can blind the entire stack at once
- Emulation-based sandboxing analyzes files on isolated infrastructure outside the host's kernel space, so a disabled EDR agent cannot prevent a verdict from being delivered
- MetaDefender Aether™ delivers 99.9% zero-day detection efficacy at 20 times the speed of traditional sandboxes, with resource efficiency 100 times greater than VM-based approaches
- Frameworks including NIS2, CMMC, NERC CIP, and IEC 62443 require protective capabilities to hold under adverse conditions, which a single BYOVD-disabled control cannot satisfy
- In a confirmed analysis of a live BYOVD toolkit, VBoxDrv.sys and Shark.sys were returned as MALICIOUS before any component could execute, showing the technique in active use against U.S. targets today
What Is a BYOVD Attack and How Does It Disable EDR
The technique itself is not complex to execute, but its consequences are difficult to contain. Once an attacker operates at the kernel level, behavioral detection fails because the sensor is no longer present. The EDR's scanning and detection components fail for the same reason, and the assumption that detection tooling will be present and functioning when it matters most starts to break down.
According to ESET, 54 of the nearly 90 EDR killer tools the company has documented use BYOVD specifically because the technique is reliable, abusing 35 vulnerable drivers in total. ESET researcher Jakub Souček noted that ransomware-as-a-service operators frequently produce new encryptor builds, and BYOVD-based killers let them keep that encryptor simple and undetected while a separate component handles defense evasion.
The Hyadina group's use of PoisonX, which is a kernel driver published to GitHub as a research tool, then used weeks later in live ransomware attacks, shows how quickly these tools move from proof-of-concept to operational deployment. ‘Blinding defenses first, encrypting second’ is no longer a technique reserved for sophisticated operators.
Security leaders should be having more direct conversations with their boards about what this implies. EDR remains a critical control but treating it as the final line of defense is becoming increasingly difficult to justify.
Why Defense-in-Depth Breaks Down Against BYOVD
Defense-in-depth assumes no single control acts as the last line of defense, and that the architecture accounts for any individual layer failing. In practice, many organizations deploy multiple endpoint tools that share the same underlying dependency: the host operating system. If that OS is compromised at the kernel level, the entire stack can be exposed at once.
The core issue is the shared attack surface, not the number of tools deployed. A BYOVD-capable adversary does not need to bypass each control individually. Loading and exploiting one vulnerable driver for kernel-level execution lets the attacker unregister EDR callbacks and terminate agent processes before host-resident detection has a meaningful chance to respond.
Blocklisting vulnerable drivers is a necessary step, but it has a structural lag problem. As Symantec researcher Brigid O Gorman explains, there is typically a gap of days, more often weeks, between a driver being identified and the blocklist update reaching enterprise endpoints. In other words, attackers routinely move faster than the list. PoisonX was published in April 2026 and used in a live ransomware attack by July. Operators who know this window exists will keep exploiting it.
Closing this gap requires analysis that operates outside the attack surface BYOVD targets: moving certain types of threat inspection off the endpoint, into an isolated layer that kernel-level compromise cannot reach, to evaluate files before they execute. At that point, the architectural conversation shifts from endpoint hardening toward pre-execution inspection.
How Emulation-Based Sandboxing Analyzes Files Outside the Kill Zone
“EDR Killers aren't outsmarting the sensor, they’re simply removing it and everything that depends on it goes with it.” says Jack Madine, Senior Product Manager at OPSWAT. “MetaDefender Aether closes that window by finishing the analysis before the file ever reaches host it could blind.”
MetaDefender Aether is OPSWAT's AI-native decision engine for zero-day detection at the network perimeter, built on application emulation rather than traditional virtual machines. That distinction is directly relevant to BYOVD, because the analysis environment never depends on the health of the endpoint it is protecting.
VM-based sandboxes can be fingerprinted. More advanced malware often detects virtualized environments and suppresses malicious behavior, producing clean verdicts for files that are not actually benign. VM infrastructure also introduces its own attack surface that determined adversaries can probe or evade; in some cases, the sandbox itself becomes a target.
MetaDefender Aether's five-layer pipeline takes a different approach. Layer 1, Threat Reputation, checks URLs, IPs, and domains against known indicators of compromise in real time. Layer 2, Predictive Alin AI/ML & Static Analysis, predicts the maliciousness of never-before-seen files using machine-learning models and deep static analysis, catching zero-day threats before any code executes.
Layer 3, Dynamic Analysis, emulates application behavior at the instruction level inside an isolated environment that runs outside the host's kernel space, on separate infrastructure. Layer 4, Threat Scoring, correlates behavioral indicators into a confidence-based risk score, and Layer 5, Threat Hunting, maps results to MITRE ATT&CK and runs machine-learning similarity search to surface malware families and campaigns.
In a confirmed analysis of a live BYOVD EDR-killer, MetaDefender Aether flagged the toolkit before any component could execute. A legitimately signed VirtualBox driver (VBoxDrv.sys) — a third-party vendor driver known to be vulnerable and commonly abused for kernel-level privilege escalation — was returned as MALICIOUS with full confidence and tagged as BYOVD, alongside a second malicious kernel driver (Shark.sys) and the loader (Sea.exe) built to deploy them.
Because the verdict is produced by instruction-level emulation on isolated infrastructure, it holds regardless of whether an endpoint agent is still alive on the host. That is exactly the condition BYOVD is designed to remove.
That separation does not imply complete coverage; no single control provides that. With 99.9% zero-day detection efficacy and resource efficiency 100 times greater than VM-based sandboxing, MetaDefender Aether delivers that inspection layer without the infrastructure overhead that makes traditional sandboxes operationally impractical at scale. The goal is not to replace endpoint protection. It is to make sure that when endpoint protection is defeated, a prior layer has already done its work.
Why Resilience Is a Compliance Obligation, Not a Design Preference
For organizations operating under NIS2, CMMC, NERC CIP, or IEC 62443, resilience carries defined control expectations, not just architectural intent. These frameworks require critical systems to maintain protective capabilities even under adverse conditions. An architecture in which a single BYOVD technique can disable a primary detection control is unlikely to meet those expectations, especially under post-incident scrutiny.
Pre-execution analysis that operates independently of endpoint state directly supports these resilience requirements. It also produces the artifacts compliance reporting tends to require: indicators of compromise, identified TTPs (tactics, techniques, and procedures), and risk scoring that security teams can present to boards and regulators as evidence of functioning, layered controls. That evidence carries more weight than documentation of controls that were deployed but later bypassed.
Trusted by more than 2,100 organizations, governments, and institutions worldwide, including 98% of U.S. nuclear power facilities, OPSWAT has built its platform around a clear principle: Trust no file. Trust no device.™. That principle is exactly what BYOVD attacks exploit when organizations abandon it at the endpoint.
Why Inspection Speed Determines Whether This Holds Up at Scale
Defense-in-depth stays theoretical if it introduces latency operations cannot absorb. High-throughput environments such as financial services, defense, and critical infrastructure cannot route every file through a sandbox that takes minutes to return a verdict. If an inspection layer becomes a bottleneck, teams work around it, and the gap it was meant to close reopens.
MetaDefender Aether's emulation architecture is built around this constraint. Lower resource requirements compared to VM-based sandboxing, paired with analysis speeds 20 times faster than traditional sandboxes, let inspection scale to enterprise file volumes across email pipelines, managed file transfer workflows, and gateway inspection points. That speed is what makes pre-execution inspection viable as a standard operational control rather than something used only after an incident.
A security architecture that holds under pressure often looks different from one that works only on paper. Threat actors using BYOVD techniques rely on the gap between documented controls and operational reality. Closing that gap by placing inspection in a layer kernel-level attacks cannot easily reach, and running it at the speed the environment requires, is what makes the architecture function in practice.
Documented intrusions have settled the question of whether EDR can be disabled. It can, and it has been, repeatedly. The remaining question is what detects the threat before it gets the chance. See how MetaDefender Aether delivers pre-execution inspection that operates independently of endpoint state.
Related Reading
MetaDefender Aether product page
Related blog: Evasive Malware Has Outgrown Traditional VM-Based Detection
Customer story: Global Financial Institution Shifts Zero-Day Protection Left with MetaDefender Aether
Frequently Asked Questions
What is a BYOVD attack?
BYOVD (Bring Your Own Vulnerable Driver) is a technique where attackers load a legitimate, signed but vulnerable kernel driver to gain Ring 0 privileges, then use that access to terminate EDR processes, disable telemetry, and clear the way for a ransomware payload.
How many EDR killer tools use BYOVD?
According to ESET, 54 of nearly 90 documented EDR killer tools rely on BYOVD, exploiting 35 distinct vulnerable signed drivers to reach kernel-level access.
Can blocklisting vulnerable drivers stop BYOVD attacks?
Blocklisting stops known vulnerable drivers, but threat actors rotate to signed drivers not yet on the list, and more capable operators use zero-day vulnerabilities in drivers unknown to Microsoft and EDR vendors, which bypass blocklist enforcement entirely.
Why are VM-based sandboxes vulnerable to evasion?
VM-based sandboxes can be fingerprinted, and advanced malware often detects the virtualized environment and suppresses malicious behavior to produce a clean verdict, even though the file is not benign.
How does emulation-based sandboxing resist BYOVD?
Emulation-based sandboxing, such as MetaDefender Aether, analyzes files on isolated infrastructure that runs outside the host's kernel space. A BYOVD attack that disables the endpoint's EDR agent has no pathway into that separate analysis environment, so inspection and verdict delivery continue regardless of host state.
Does pre-execution inspection replace EDR?
No. EDR remains an important control in the overall architecture. Pre-execution inspection adds a layer that completes its work before an attacker has the chance to disable host-based controls, supporting layered resilience rather than replacing endpoint protection.
