Kasseika Threat Actor has joined the club of Threat Actors that currently use Bring Your Own Vulnerable Driver (BYOVD) tactics to disable antivirus/EDR software before carrying out malicious activities, such as encrypting files. Kasseika abuses the Martini driver, part of the TG Soft’s VirIT Agent System. By using BYOVD attacks, the malware gains privileges it can use to terminate various processes (included as a hardcoded list), many of which correspond to antivirus/EDR/security/analysis and system utilities. Kasseika ransomware utilizes the ChaCha20 and RSA encryption algorithms to encrypt target files, appending a pseudo-random string to the filenames, similar to BlackMatter ransomware. More information at this link.
Massimo Giaimo
Team Leader Cyber Security at Würth Phoenix and Head of Cyber Threat Intelligence at Würth Group
Author
Latest posts by Massimo Giaimo
10. 10. 2025
SEC4U, Threat Intelligence
NetEye Conference 2025: The Correct Analysis for Some Use Cases
04. 08. 2025
SEC4U, Threat Intelligence
Favicon Intelligence – Detecting Clones Of Official Web Services
01. 11. 2024
Threat Intelligence
Our Contribution to Mitre Att@ck