RANSOMWARE GANGS EXPLOIT PARAGON PARTITION MANAGER BUG IN BYOVD ATTACKS

Summary from the TLDR InfoSec newsletter

Microsoft discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, one of which was actively used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. The drivers are signed by Microsoft, so they can also be used in Bring Your Own Vulnerable Driver (BYOVD) attacks. Microsoft recommends enabling the Microsoft Vulnerable Driver Blocklist to prevent BYOVD attacks.