Attackers will accelerate their investments in cookie theft
Ian Pratt, HP Global Head of Personal Systems Security
Generalized MFA deployment will accelerate threat actors’ switch to stealing cookies and tokens instead of passwords. This means threat actors will need to act swiftly from time of theft, utilizing the stolen cookie before it expires to insert backdoors that then grant them persistent access. Online marketplaces will expand to enable this with rapid trading and exploitation.
Defenses against cookie and token theft are not mature and are inconvenient for users. This means that we will see attacks involving such theft becoming increasingly commonplace. This is particularly serious for privileged users such as sysadmins, who frequently use web browsers to access high value administrative web sites, such as EntraID, InTune, or AWS web portals, where cookie theft creates an easy path to a catastrophic enterprise breach.
Issuing sysadmins with a second PC, a Privileged Access Workstation (PAW), is today’s recommended best practice, but is far from universally implemented, and there are plenty of examples where PAWs themselves have become compromised.
For critical applications, enterprises are going to need to look toward additional layers of defense, such as strong isolation and application security posture attestation.
Cybercriminal Groups Will Rely on AI Agents to Automate Reconnaissance and Target
Organizations
Alex Holland, Principal Threat Researcher in the HP Security Lab
“In 2026, we expect to see organized crime groups automate workflows and outsource more tasks using AI agents in their attacks, especially preparatory tasks like researching victims to target. Beyond this, rapid improvements in large language models and agentic AI systems are expanding their role in the attack lifecycle. Threat actors will no longer limit their AI use to basic automation or phishing content creation. They will also start using AI to assist with complex tasks like vulnerability discovery.
“AI assistance will help threat actors to scale their operations, making campaigns more efficient by reducing the resources and skills attackers need to breach targets.
“Against a barrage of AI-assisted attacks, even the best detection tools will miss some threats. Instead, organizations need to ensure threats can be contained, isolated and remediated, safeguarding their fleets, maximizing uptime and ultimately securing the future of work.”
Physical Attacks on Devices Will Become Cheaper and Easier for Cybercriminals
Boris Balacheff, Chief Technologist for Security Research and Head of the HP Security Lab
“Hybrid work is accelerating the commoditization of attacks enabled by physical access to devices. This is because devices are more exposed as employees are more mobile and distributed, and the tools needed for device tampering become increasingly accessible and affordable. Next year, IT leaders should anticipate this will continue, with easy-to-use exploitation kits and investment by threat actors into new physical attack techniques. In response, security auditors will increasingly focus on how organizations deploy best practices to protect data and device integrity across their fleets of devices.
“Employees today work in cafés, bars, hotels, and conference centers across the globe, using shared infrastructure and peripherals, and giving threat actors ample opportunity to tamper with a device when its owner steps away. With physical tampering, threat actors can seek to exfiltrate data, grasp control of compromised devices to gain broader access to enterprise networks, and even mount destructive attacks to brick devices that are not designed with self-healing built in from the ground up.
“To ensure the Future of Work is secure, organizations will need to prioritize hardware with security and resilience built in at every level. They will need to look for device security capabilities to help protect hardware and firmware integrity, as well as data security, from physical attacks, and learn to integrate hardware-level authentication and attestation into their zero-trust architecture strategies.”
Organizations will Finally Take Notice of IoT, Edge, and Print Security After a String of Attacks
Steve Inch, Global Senior Print Security Strategist at HP Inc.
“After a year of high-profile attacks against connected devices, organizations will finally prioritize security for devices at the network edge. For example, security vulnerabilities allowed for remote takeovers of printers, highlighting the risks of leaving printers unprotected.
“For too long, printers have been the lowest priority on every security team’s list. Many organizations lack basic visibility and control over print infrastructure. This creates security blind spots – from exploitation attempts to insider threats, outdated firmware, malicious updates and misconfigurations, such as open ports or unchanged default credentials.
“These security gaps give threat actors a potential launchpad to not only compromise a printer and the data it holds but also other devices on the network. In the year ahead, organizations and governments will demand that endpoint devices like printers come with continuous and active system monitoring throughout their lifecycle.
“To defend the Future of Work, organizations need to secure their complete device ecosystem, including their printers. They should prioritize the ability to automate print fleet security compliance and automatically assess fleet firmware vulnerability status, minimizing IT overhead in 2026.”
Quantum Resistance will Become a Vendor Requirement
Thalia Laing, Principal Cryptographer at HP Security Lab
“A year on from the introduction of new NIST standards for quantum-resistant asymmetric cryptography, public sector and critical infrastructure companies are going to accelerate planning and vendor engagements to chart a path towards migration. This process will reveal the scale of the challenge: with NIST intending to deprecate RSA-2048 by 2030 and all RSA and Elliptic Curve Cryptography by 2035, many vendors are likely to seize the opportunity to move directly from RSA 2048 to quantum resistant algorithms, particularly in critical industries and long-life systems, such as hardware.
With ongoing advances in quantum computing, the prospect of a quantum computer capable of breaking asymmetric cryptography within a decade is becoming increasingly plausible. The US government’s decision to set a quantum-resistance deadline of 2027 for new National Security System devices signals this urgency.
“To become quantum resilient, organizations must start by preparing their long-lived hardware, including their printers and PCs. With a typical commercial PC refresh averaging at just over 4 years and an even longer lifespan for office-class commercial printers – devices procured in 2026 have the potential to be in use within the timeframe of a cryptographically relevant quantum computer.
“From 2026 onwards, quantum resilience will increasingly influence hardware procurement decisions. This will increase pressure on device manufacturers to future-proof their devices by embedding quantum resistant cryptography into their products, while pushing for the protection of long-life data. By embedding quantum resilience now, organizations can maintain trust in the
technologies shaping the Future of Work.”
The Spotlight draws over Identity, Provenance, and Persistent Control
Peter Blanchard, Document Workflow Security Strategy Principal at HP Inc.
“In 2026, we’ll see efforts within enterprise security shift from fragmented identity frameworks and perimeter-based controls to a unified, data-centric model. Today’s zero-trust implementations often create complexity and fatigue, with identity scattered across users, apps, and devices. This fragmentation leads to blind spots, inconsistent enforcement, and poor user experience. The next phase will prioritize consolidation: centralized identity orchestration that simplifies access, strengthens governance, and reduces operational risk.
At the same time, we’ll see security move from focusing on point of entry, to managing the custody of data throughout its lifecycle. Organizations will need visibility into where data originates, how it is used, and who has access – even after it leaves their boundaries. Identity and policy will travel with the data, embedded through persistent controls, telemetry, and rich metadata. Dynamic permissions such as ‘can I share this?’ will evolve into continuous oversight, ensuring compliance online and offline.
Provenance and lifecycle control will become critical in the age of AI, where transparency and trust are non-negotiable. By embedding identity, custody, and governance controls into the core of digital ecosystems, organizations will achieve stronger, adaptive security that protects without adding friction, safeguarding the Future of Work.”
DeadLock Ransomware Uses New “BYOVD” Method to Disable EDR
Posted in Commentary on December 10, 2025 by itnerdResearchers have revealed that a financially motivated threat actor deploying DeadLock ransomware has adopted a sophisticated Bring Your Own Vulnerable Driver (BYOVD) tactic to bypass and disable endpoint detection and response (EDR) mechanisms.
Talos observed a threat actor leveraging a BYOVD technique to disable endpoint detection and escalate privileges in an attack that eventually delivered DeadLock ransomware as the payload.
The attack relied on “BdApiUtil.sys”, a legitimate Baidu Antivirus driver containing an Improper Privilege Management vulnerability with CVE-2024-51324 — which the actor disguised using the file name “DriverGay.sys”. This Improper Privilege Management vulnerability exposes a critical function in the driver program that allows unprivileged users to terminate any process on the system at the kernel level.
Commenting on this is Borja Rodriguez, Manager of Threat Intelligence Operations at Outpost24:
“This technique is not new. It follows a pattern we have seen for many years. The concept of abusing signed drivers is old. Drivers have long been a privileged entry point to the kernel (and thus attractive for attackers). But such abuses often occurred under vague names (“rootkits,” “driver exploitation,” “kernel-mode malware”), that weren’t necessarily documented under a unified label like “BYOVD.”
Campaigns like InvisiMole and Slingshot APT (both reported in 2018) already used similar methods, taking advantage of vulnerable or malicious drivers to gain high privileges, hide activity, and bypass security tools. These cases showed early examples of what we now call BYOVD attacks.
In the ransomware world, this isn’t new either. Groups such as Cuba Ransomware have already used BYOVD techniques to disable security products by loading vulnerable drivers and terminating protection processes. The technique itself hasn’t changed much. What has really changed is that attackers have learned how profitable ransomware can be, so they are reusing methods that previously appeared mainly in espionage operations.
Overall, this reflects a simple trend: if a technique works for one threat actor, others will copy it. Just like trends in other industries, proven tactics tend to come back again and again.”
ESET_InvisiMole.pdf
The Slingshot APT FAQ | Securelist
https://cymulate.com/blog/defending-against-bring-your-own-vulnerable-driver-byovd-attacks/
This is one of those cases where everything old is new again. That’s something for defenders to keep in mind as they work to keep their organizations secure.
UPDATE: Ensar Seker, CISO at SOCRadar adds this:
“The use of BYOVD by the DeadLock ransomware group is a stark reminder that ransomware actors are no longer just encrypting files, they’re now going after the very defenses meant to stop them. By leveraging signed but vulnerable drivers to disable EDR, threat actors can effectively go ‘under the radar,’ removing visibility at the precise moment an attack unfolds. This is no longer just a red team tactic, it’s now weaponized in the wild by financially motivated actors. Organizations must harden their driver policies, implement driver blocklists like Microsoft’s recommended vulnerable driver list, and monitor for suspicious driver loads in telemetry. Endpoint protection alone is no longer enough; a layered, adversary-aware defense model is required.”
Leave a comment »