Researchers spot Medusa ransomware operators deploying smuol.sys This driver mimics a legitimate CrowdStrike Falcon driver Medusa is actively targeting critical infrastructure organizations Operators of the Medusa ransomware are engaging in old-fashioned bring-your-own-vulnerable-driver (BYOD) attacks, bypassing endpoint protection, detection and response (EDR) tools while installing the encryptor. Cybersecurity researchers Elastic Security Labs noted the attacks start as the threat actors drop an unnamed loader, which deploys two things on the target endpoint: the vulnerable driver, and the encryptor. The driver in question is smuol.sys, and it mimics a legitimate CrowdStrike Falcon driver named CSAgent.sys. It was also said to have been...