Page 2 - Windows Hardware Developer Program News Today

Microsoft is still digitally signing drivers that contain malware, with no end in sight. Here's what to do about it.

The ransomware gang was able to use signed malicious drivers to disable endpoint security tools. Microsoft has revoked the certificates.

An Ottawa-area IT services company says it has completely restored service to its customers after being hit by the Cuba ransomware strain last week. However, they lost a day's worth of email and data. Marc Villeneuve, owner of 2NetworkIT, credits having a resilient backup strategy for being able to bypass the issue of 11 encrypted

Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The most pressing patches include a zero-day vulnerability in a Windows feature that tries to flag malicious files from the Web, a critical bug in PowerShell, and a dangerous flaw in Windows 11 systems that was detailed publicly prior to this week's Patch Tuesday.

Microsoft has warned that malicious hackers were able to get the software giant to digitally sign their code so it could be used in attacks, such as the deployment of ransomware.

Using this technique, the ransomware gang can drop malware that is inherently trusted by any Windows system, security researchers say.

Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The most pressing patches include a zero-day vulnerability in a Windows feature…

Microsoft disclosed that it suspended several developer program accounts that were able to obtain drivers certified by its Windows Hardware Developer Program that likely deployed ransomware.

Several cybersecurity firms have warned Microsoft that cybercriminals have been using signed malicious drivers to kill antivirus and EDR processes.

Malicious Windows drivers signed as legit by Microsoft have been spotted as part of a toolkit used to kill off security processes in post-exploitation cyber activity.