> EDR killer tool uses signed kernel driver from forensic software
[AUTHOR: Bill Toulas]
[DATE: 04/02/2026 14:17]
[LANGUAGE: EN]
Hackers are abusing a legitimate but long-revoked EnCase kernel driver in an EDR killer that can detect 59 security tools in attempts to deactivate them. [...]