BlackByte Ransomware Abuses Driver Vulnerability to Disable Security Products

Attackers use a sophisticated technique to bypass security products by abusing a known vulnerability in the legitimate vulnerable driver RTCore64.sys. The evasion technique supports disabling a whopping list of over 1,000 drivers.