A new ransomware strain is using signed Windows drivers to disable Microsoft Defender before encrypting files. Here's how to detect it and what compensating controls to deploy.
The variant abuses a legitimately signed but vulnerable driver (a "bring your own vulnerable driver" attack) to terminate Defender and other security agents from kernel space before encryption begins.
These controls are part of our standard hardening. If you're not sure yours are in place, call us — we'll verify today.
The grammar mistakes that used to betray a phishing email are gone. Generative AI lets attackers write convincing, personalized messages at scale — and your built-in Microsoft 365 filter was not designed to stop them.
AI tools have made it as cheap to attack a five-person firm as a five-hundred-person enterprise. Here is what that shift means for your business and what you can realistically do about it.
Scattered Spider is the threat group behind some of the most devastating breaches of 2025–2026, including attacks on major enterprises and dozens of mid-market companies. Here's how they operate and how to defend.