Hyadina

Hyadina first emerged in March 2022, when it was seen deploying its Monster ransomware variant. Monster was primarily written in Delphi and targeted 32-bit Windows operating systems. It avoided targeting machines that appeared to be located in the Commonwealth of Independent States (CIS). Hyadina appeared to operate Monster as a typical ransomware-as-a-service operation, working with affiliates to carry out attacks.

One of the hallmarks of a November 2022 Monster attack documented by Symantec was the use by the attackers of a password protected self-extracting archive containing the Mimikatz credential-dumping tool and a large number of password-harvesting tools developed by NirSoft, much like the tools we saw used in this recent GodDamn attack, with many of the same tools used, including AnyDesk and NetScan also.

Hyadina then rebranded its ransomware as Beast in June 2024. The attackers leveraged a similar toolset as used in earlier Monster attacks, however, the update also made a number of fixes and changes that allowed for greater customization and control by the attacker, as well as enhancing the performance of the encryption process. Another notable change to the capabilities of Beast was the addition of support for targeting Linux and VMware ESXi operating systems instead of just Windows-based computers. Like before, the ransomware made extensive use of NirSoft tools and avoided targets in multiple countries of the CIS. However, support for various languages, including Chinese, showed that the threat actor was casting its net wide open.

In activity investigated by Symantec in June 2025, we observed Beast ransomware attackers using a custom tool for finding valid admin credentials, as well as some other tools that were not used previously alongside the ransomware. These included the Gmer rootkit scanner, which was used to kill processes, Defender Control to disable Windows Defender, and the IObit Unlocker to help with unlocking locked files and folders.

GodDamn appears to be the latest ransomware iteration from this group, which continues to develop its stealth and defense evasion capabilities. GodDamn's use of the relatively newly discovered PoisonX malicious driver component represents an escalation in defensive evasion capability by this group, indicating that Hyadina is continuing to actively develop its ransomware and its capabilities.

Protection/Mitigation

For the latest protection updates, please visit the Symantec Protection Bulletin.

Indicators of Compromise (IOCs)

File indicators

141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944 – PsExec – psexesvc.exe
17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180 – Netpass – netpass64.exe
19bab15a34d5ad838ccf4d187eb40379c335fa56446d0f9621865b2767d4ac7d – WirelessKeyView – wirelesskeyview64.exe
2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d – PoisonX Driver – g11.sys
31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc – Mimikatz – mimik.exe
35296e7a34688ca3e3159bcdf92b4d60ba4173a2369aca531bb7bc959f68ed9c – CredentialsFileView – credentialsfileview64.exe
45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220 – AnyDesk – anydesk.exe
5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd – Mailpassview – mailpv.exe
5c4c98d774eb100f9a89ae4e984c27a4f532e58c7cf8c87046dc87db5a065404 – ChromePass – chromepass.exe
5e85446910e732111ca9ac90f9ed8b1dee13c3314d2c5117dcf672994ce73bd6 – PstPassword – pstpassword.exe
7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26 – MessengerPass – mspass.exe
816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019 – VNCPassView – vncpassview.exe
8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8 – OperaPassview – operapassview.exe
8ff1c1967841a595d996a649c8134b7a5970dcf94624b237d1b089e7c6266167 – Webbrowserpassview – webbrowserpassview.exe
9fae3f15900e13ec3860a109555ecd33ca43d38907c63438c50a2d6d91bfee1d – Netscan – netscan.exe
b29f91a440527fb621d106a2048f6379fff3263c60aeda9c82ff8c1d5ae880a8 - Defense evasion tool – Symantec.exe
c92580318be4effdb37aa67145748826f6a9e285bc2426410dc280e61e3c7620 – SniffPass – sniffpass64.exe
e097f3b445b63b07afacde8d6a67f0be654dd51e228a3610fb0710a1f7e29a69 - GodDamn ransomware – encrypter-windows-gui-x86.exe
ece33e4b7e2d26eeca8ad9db4439f9801a7a77e332611116156738b1b0316046 – Extpassword – extpassword.exe
faca9e856c369b63d6698c74b1d59b062a9a8d9fe84b8f753c299c9961026395 – PasswordFox – passwordfox64.exe

2b:T664,

Defense evasion has quietly become one of the most consequential stages of an advanced cyber intrusion. As security products have grown harder to beat, attackers have changed their tactics. Rather than attempting to fly under the radar, they are opting to switch off security altogether. With ransomware attacks, in particular, attempting to disable security software is now a standard part of the attack chain.

One technique has come to dominate the area of defense evasion and, over the past three years, it has become something close to an epidemic. The Bring Your Own Vulnerable Driver (BYOVD) technique lets attackers abuse flaws in legitimate, validly signed kernel drivers to seize control of the Windows kernel itself and operate at the highest level of privilege on a machine.

Hundreds of vulnerable drivers are already in circulation. New ones are uncovered and shared openly on a regular basis and ready-made BYOVD tooling is now routinely bundled into ransomware-as-a-service (RaaS) offerings alongside the payloads themselves. Once operating in the kernel, attackers can blind, cripple, or simply kill the very products meant to stop them. Furthermore, as this research shows, the kernel hardening Microsoft has built into Windows does little to get in their way.

These techniques, and the defensive measures that can counter them, are examined in detail in the Symantec Threat Hunter Team's latest whitepaper: Lights Out: Defense Evasion in the Age of BYOVD.

2c:T632,

Why attackers go to the kernel

Windows runs code at two levels of privilege. User mode is where everyday applications live, and the operating system limits what they are allowed to do. Kernel mode is where the operating system itself runs, and code executing there has almost no restrictions. An attacker who reaches kernel mode can read or change nearly anything on the machine, including the security software trying to protect it.

Vulnerable drivers are the attacker's most reliable route in. A driver is a piece of trusted, digitally signed code that the operating system loads to handle specialist tasks and the Windows kernel fully trusts third-party drivers once they are loaded. The attacker, having gained administrator privileges, can drop a flawed but validly signed driver onto the target machine. Because the driver is signed, Windows loads it automatically. The attacker then sends the driver a specially crafted command that exploits the flaw, and the driver carries out actions on the attacker's behalf that no ordinary program could.

The most common action is to kill the processes belonging to antivirus (AV) or endpoint detection and response (EDR) products, stripping the machine of its defenses. Some variants are more subtle. Attackers may strip the security agent of the rights it needs to function correctly, leaving it running but unable to act. Others tamper directly with the kernel's internal records so that the security product no longer receives notifications about what is happening on the machine, effectively making it blind.

2d:T1b12,

A commoditized technique

BYOVD is popular because it is so effective and relies on legitimate, signed files, which are less likely to raise red flags. A wide range of drivers can be abused this way, with anti-rootkit drivers developed by security vendors among the most exploited. Ready-made tools that automate the attack are openly traded and shared. Examples include TrueSightKiller, a publicly available tool that leverages a vulnerable driver named truesight.sys; GhostDriver, another publicly available process killer; AuKill, which abuses an outdated version of the driver used by the Microsoft utility Process Explorer; and Poortry, a malicious driver whose developers are believed to have succeeded in getting it signed.

Several of these tools have become standard parts of the ransomware toolkit, and a small number of ransomware operators now build their BYOVD component directly into the ransomware payload itself.

Not every attack needs a driver

While BYOVD dominates the picture, it is not the only route attackers can take. Windows shields AV and EDR services with a mechanism called Protected Process Light (PPL), which prevents even administrators from terminating them. The rules, however, leave gaps. An administrator cannot kill a protected process, but they can suspend it, and a paused security product is just as good as a stopped one. Its scans stop completing, yet it still appears to be running, so the restart logic that would normally bring it back to life never triggers and users see no obvious failure.

Windows also arranges its most sensitive processes into a hierarchy of trust levels, and an attacker who can take over or impersonate a process at a higher trust level than the security product gains the right to terminate or tamper with it. Other attackers ignore the local machine altogether and quietly cut the security product off from the vendor's cloud services it depends on for reputation lookups and file-prevalence checks. The agent looks healthy, but its decisions are made with much less information.

Kernel hardening is not enough

Microsoft has added a series of protective features to the Windows kernel over the past decade to make kernel access less useful to an attacker. Kernel Address Space Layout Randomization (KASLR) makes kernel structures harder to find. Hypervisor-Protected Code Integrity (HVCI) stops attackers from patching kernel code. Kernel Control Flow Guard (KCFG) and hardware-enforced stack protection constrains how control can move through the kernel. Each one closes off a category of attack that would otherwise be available. Each one also has a publicly known bypass.

More importantly, the attacks most used against AV and EDR products do not fall into any of the categories these features block. The attacker is not trying to run new code in the kernel, redirect how the operating system works, or rewrite the memory map. They are simply changing information the operating system already holds; flipping the field that says which processes are protected, clearing the entries that tell the kernel which security products want to be notified of events, or downgrading the privileges of a running security agent. These data-only attacks route around kernel hardening entirely.

Microsoft's published servicing criteria for Windows are explicit that, for the New Technology (NT) kernel, administrator-to-kernel is not a security boundary. Attacks of this kind are treated as bypasses of mitigations rather than as exploitation of vulnerabilities, and fixes, when they come, arrive without CVEs and outside the standard security-response process. Kernel hardening is worth deploying, but it cannot be relied on as the primary defense against the attackers seen in the wild.

Shifting the balance: Proactive, not reactive, defenses

Two defensive approaches dominate today's response to BYOVD, and both have meaningful limitations. Microsoft's Vulnerable Driver Blocklist stops recent Windows installations from loading drivers known to be vulnerable, but there is a lag of days, more often weeks, between a driver being identified and the blocklist update reaching enterprise endpoints. Only a subset of known vulnerable drivers is blocklisted at any given time. When defenders block one driver, attackers simply switch to the next.

Signature-based detection faces a similar problem. Many BYOVD tools begin life as open-source proof-of-concept projects on public code-sharing platforms. When the original project is flagged, attackers re-implement it within days, often in a different language. The same underlying technique has been reimplemented in C, C++, C#, Rust, and Go in rapid succession, and each language change defeats the existing hash signature. The result is that static defenses keep defenders permanently reactive.

The approach that genuinely shifts the balance is to monitor what files do when they interact with kernel drivers, not simply which drivers are loaded. Whether a BYOVD tool is a year-old C++ project or a fresh Rust port written last week, the operational pattern is largely the same. A vulnerable driver is dropped to disk. A service is created and started to load it. The malicious component then enumerates running processes and sends the driver a specific input/output control (IOCTL) command instructing it to take a privileged action against security software. Symantec and Carbon Black endpoint products now include behavioral monitoring of these driver interactions, flagging anomalous IOCTL traffic such as process termination requests directed at security products, handle stripping that would crash a security process, and callback removal that would blind the EDR.

This protection is driver-agnostic. A request to terminate a running security product is anomalous regardless of which driver is being asked to perform it, so the detection does not depend on identifying the driver in advance, and it can catch an unknown vulnerable driver the first time it appears in the wild. A vulnerable driver that emerges this week can be covered by behavioral protection immediately. The time advantage attackers have enjoyed since BYOVD became popular is beginning to narrow. Only Symantec and Carbon Black Endpoint products provide comprehensive protection at a behavioral level.

Learn more about this threat in our comprehensive whitepaper: Lights Out: Defense Evasion in the Age of BYOVD.

2e:T5be,

Zero Trust is by no means standing still. As attackers continue to adopt AI to automate reconnaissance, accelerate attacks, and hasten their exploits, organizations need network security that moves just as quickly. At the same time—as if AI-wielding attackers weren’t enough—hybrid work, cloud first architectures, and emerging AI workflows have pushed the traditional security perimeter to new, perilous horizons.

SOCs can’t afford to put their trust in just any platform. To stay ahead, security teams need a Zero Trust platform that delivers consistent protection across users, applications, and data—without adding complexity to already convoluted environments.

That’s why we’re excited to share that Broadcom was recognized as a Leader in four distinct categories in the 2026 KuppingerCole Leadership Compass for Zero Trust Platforms. For Symantec Security Service Edge (SSE), this recognition reinforces what we already know: Exemplary Zero Trust security goes beyond a simple checklist to deliver a unified SSE platform that’s built for the AI era—and what lies ahead.

2f:T797,

Performance starts with the network

Fast, secure access isn’t as good when it comes with a trade-off. Because Symantec SSE is delivered over Google’s private backbone, organizations benefit from high-performance, resilient connectivity with direct peering to major cloud providers. Users get to stay productive with secure access that doesn’t compromise speed or reliability.

Security that follows your data

Data protection should never be an afterthought. With Symantec DLP embedded directly into the SSE data path, policies follow data wherever it moves. Better yet, a single management experience ensures consistent policy enforcement across ZTNA, Secure Web Gateway (SWG), CASB, email, and endpoints for a simpler secure experience.

Protection is built in, not layered on

You may have already noticed a pattern, but the strongest security is one that’s already built into the platform from the start. In Symantec SSE, Remote Browser Isolation (RBI) is integrated directly into ZTNA. This isolates risky web sessions in the cloud before threats can ever reach the endpoint, eliminating the need for a separate infrastructure while still reducing exposure to web-based attacks.

Designed with the future in mind

How we work is changing—and AI is at the forefront of it. As agentic AI introduces new identity and access challenges, Zero Trust platforms need to keep up. By preserving user identity through ZTNA as an MCP gateway with Secure On-Behalf-Of token exchanges, Symantec SSE helps maintain least-privilege access while inspecting AI prompts and responses. This approach allows organizations to securely adopt AI and freely innovate without the risk of creating new blind spots.

30:T711,

Trusted by enterprises, validated by experts

Security leaders often make technology decisions that will shape their organizations for years to come. Vendor promises alone aren’t enough to inform those decisions. They deserve independent proof.

That’s why at Symantec and Carbon Black, we continue to participate in rigorous third-party evaluations year after year, earning multiple industry recognitions that serve a dual purpose: reinforcing our mission to deliver tried, trusted, and true enterprise-grade security while proving our solutions continue to perform at the highest level.

The ideal choice for mid-sized and large enterprises—especially in highly regulated sectors like FinServe and Government—Symantec SSE is designed to handle the toughest security challenges so your teams don’t have to. From securing unmanaged devices and enabling Zero Trust access to protecting data across complex AI workflows, Symantec SSE helps teams strengthen security without forcing a tradeoff between productivity and safety. And those same enterprise-grade capabilities that protect the most complex environments also make Symantec SSE a trusted choice for organizations of every size.

Want to see why industry analysts continue to recognize Symantec SSE? Dive into the full KuppingerCole report to further explore why Broadcom was named a quadruple Leader.

31:T89b,

Some pairings are just destined for greatness. Think Leslie Knope and Ben Wyatt in Parks and Rec. Two distinct powerhouses whose combined strengths accomplished far more together than either ever could alone.

When Symantec and Carbon Black joined forces, we knew the possibilities of this pairing would far surpass what either legacy brand could achieve alone. This was a partnership made in tech heaven combining Symantec’s enterprise-grade scope with Carbon Black’s sharp EDR capabilities. And it helped that we genuinely loved each other’s product lineages, with no dead weight or filler in the lineup.

It was also a case of perfect timing. We came together at a moment when it was clear cybersecurity was undergoing a seismic shift. Two years ago, we observed that no organization, no matter its size, was safe from the threats that traditionally targeted large enterprises. A year later, our acclaimed threat hunter team observed that APTs and nation-state sponsored threat actors had begun to expand their sights beyond large corporations and government entities. They were coming for everyone, no matter their size or sophistication. And those bad actors were bringing the kinds of tools and techniques most security teams weren’t fully prepared for: An increase in living of the land (LOTL) attacks, for instance, followed by the rise of agentic AI attacks and AI-accelerated threats, and later, a vexing new habit among attackers of stealing encrypted data and holding onto it in anticipation of decrypting it the post-quantum computing era.

32:T48e,

An enormous opportunity

At the same time, we saw how the vast majority of the market had been largely overlooked by vendors whose primary focus was on solving the problems of very large enterprises, which resulted in solutions that really were tuned to those customers—customers with extensive budgets and abundantly resourced SOCs. Solutions so complicated that they required substantial in-house expertise to get the most from them. With all these sophisticated threats advancing on, well, virtually everyone, we recognized that every organization deserved enterprise-grade security, even if they don't have enterprise-sized resources or budgets.

Meanwhile, some age-old challenges faced by security teams weren't disappearing. Alert fatigue. Time wasted chasing down threats. And a nagging sense that no matter how hard they try, they just can't seem to get ahead of the next day's assaults.

We knew the market needed something different, and we knew those two brands provided the product foundation to deliver it.

33:Ta64,

Getting right to work

From the start, we signaled we’d be unifying their two product portfolios over time. A key first step was to unite all products on Google Cloud, giving both brands the scalable foundation we knew the future would demand of us.

While working on additional collaborations with Google Cloud that increased security system performance by up to 100X compared to competing solutions, we were busy developing the first XDR platform to combine the best of both brands into a unified platform: Symantec® CBX. Built on the expertise that made Symantec and Carbon Black trusted names across the industry, Symantec CBX reflects years of hard work, dedication, and tenacity aimed at one goal: helping defenders stay ahead of the curve by delivering enterprise-grade protection to organizations of all sizes.

Pulling from both legendary portfolios, CBX gives security teams comprehensive visibility and stronger response capabilities across endpoints, networks, and data. By including AI-powered capabilities like Adaptive Protection and Threat Tracer, it builds on Symantec’s long-standing leadership in threat intelligence and Carbon Black’s renowned EDR expertise to power deeper endpoint visibility and investigation workflows defenders can rely on day after day.

More than a simplified XDR platform, CBX is the natural evolution of two tech powerhouses that have spent years on the frontlines, protecting organizations around the world. Best of all, it’s the first XDR platform built specifically to address the largest and most overlooked swath of the cybersecurity customer market: less-resourced security teams that increasingly face AI-powered, enterprise-grade threats but lack the budgets and in-house expertise to implement enterprise-grade defenses.

34:T756,

AI that works for you

AI has quickly become one of the most powerful tools available to defenders—when it’s used the right way. By integrating Google Gemini into many of our key protections, we’ve made it easier for analysts to understand complex security events and move investigations forward where they’d usually stall. Analysts can ask natural-language questions about incidents and receive clear, actionable answers within seconds. CBX also generates Investigation Summaries that save countless cycles for analysts who previously had to correlate signals and alerts across the entire attack surface; these summaries do the heavy lifting by automatically correlate signals and present well-written analyses of attacks, while offering clear, helpful recommendations for immediate remediation.

For experienced analysts, this means faster investigations and clearer context across alerts, but for newer team members it provides pivotal assists, helping them understand incidents and remediation steps without getting buried under piles of raw telemetry. At the same time, advanced features like Symantec’s groundbreaking Incident Prediction and Carbon Black’s Threat Tracer, both now part of Symantec CBX, lead the path to seeing and stopping attacks, while offering a more complete view of the attack surface.

Without these efforts and carefully thought out collaborations, the progress we’ve made today wouldn’t have been possible.

35:T9db,

Building a future for customers everywhere

The current threat landscape is unforgiving. New attacks surface daily, and thousands of alerts hound SOCs without recess as bad actors constantly search for new weaknesses to exploit. Meanwhile, frontier AI is changing the security landscape, and it’s only a matter of time before attackers get their hands on the highly advanced and capable models that large enterprises are deploying to protect themselves.

At Symantec and Carbon Black, we believe every defender deserves frontier AI. They deserve tools designed to help them adapt, detect, and respond to even the most sophisticated threats. They deserve solutions like Symantec CBX that incorporate support for post-quantum cryptography measures by protecting against “harvest now, decrypt later” attacks. And they deserve the personalized support that will help them make the most of these protections. Security teams know the stakes have never been higher. That’s why we’ve kept our eyes on the horizon, preparing both for what’s here and what’s coming.

Our shared drive, backed by Broadcom’s remarkable R&D engine, helped fuel innovations like Symantec CBX. In fiscal 2025 alone, Broadcom invested $10.977 billion— that’s $20,885 a minute—in R&D. We’ve been uniquely fortunate to have that remarkable force for innovation at our back.

Because when defenders have access to tried, trusted, and true defenses—and the right partners behind them—security teams everywhere gain the advantage they deserve.

Catch a demo of Symantec CBX and see what unified and simplified security is all about. Reach out to your in–region expert.

Want to learn even more? Catch our CBX Fest summer webinar series where we go deep on every aspect of this remarkable platform.

36:T5be,

Zero Trust is by no means standing still. As attackers continue to adopt AI to automate reconnaissance, accelerate attacks, and hasten their exploits, organizations need network security that moves just as quickly. At the same time—as if AI-wielding attackers weren’t enough—hybrid work, cloud first architectures, and emerging AI workflows have pushed the traditional security perimeter to new, perilous horizons.

SOCs can’t afford to put their trust in just any platform. To stay ahead, security teams need a Zero Trust platform that delivers consistent protection across users, applications, and data—without adding complexity to already convoluted environments.

That’s why we’re excited to share that Broadcom was recognized as a Leader in four distinct categories in the 2026 KuppingerCole Leadership Compass for Zero Trust Platforms. For Symantec Security Service Edge (SSE), this recognition reinforces what we already know: Exemplary Zero Trust security goes beyond a simple checklist to deliver a unified SSE platform that’s built for the AI era—and what lies ahead.

37:T797,

Performance starts with the network

Fast, secure access isn’t as good when it comes with a trade-off. Because Symantec SSE is delivered over Google’s private backbone, organizations benefit from high-performance, resilient connectivity with direct peering to major cloud providers. Users get to stay productive with secure access that doesn’t compromise speed or reliability.

Security that follows your data

Data protection should never be an afterthought. With Symantec DLP embedded directly into the SSE data path, policies follow data wherever it moves. Better yet, a single management experience ensures consistent policy enforcement across ZTNA, Secure Web Gateway (SWG), CASB, email, and endpoints for a simpler secure experience.

Protection is built in, not layered on

You may have already noticed a pattern, but the strongest security is one that’s already built into the platform from the start. In Symantec SSE, Remote Browser Isolation (RBI) is integrated directly into ZTNA. This isolates risky web sessions in the cloud before threats can ever reach the endpoint, eliminating the need for a separate infrastructure while still reducing exposure to web-based attacks.

Designed with the future in mind

How we work is changing—and AI is at the forefront of it. As agentic AI introduces new identity and access challenges, Zero Trust platforms need to keep up. By preserving user identity through ZTNA as an MCP gateway with Secure On-Behalf-Of token exchanges, Symantec SSE helps maintain least-privilege access while inspecting AI prompts and responses. This approach allows organizations to securely adopt AI and freely innovate without the risk of creating new blind spots.

38:T711,

Trusted by enterprises, validated by experts

Security leaders often make technology decisions that will shape their organizations for years to come. Vendor promises alone aren’t enough to inform those decisions. They deserve independent proof.

That’s why at Symantec and Carbon Black, we continue to participate in rigorous third-party evaluations year after year, earning multiple industry recognitions that serve a dual purpose: reinforcing our mission to deliver tried, trusted, and true enterprise-grade security while proving our solutions continue to perform at the highest level.

The ideal choice for mid-sized and large enterprises—especially in highly regulated sectors like FinServe and Government—Symantec SSE is designed to handle the toughest security challenges so your teams don’t have to. From securing unmanaged devices and enabling Zero Trust access to protecting data across complex AI workflows, Symantec SSE helps teams strengthen security without forcing a tradeoff between productivity and safety. And those same enterprise-grade capabilities that protect the most complex environments also make Symantec SSE a trusted choice for organizations of every size.

Want to see why industry analysts continue to recognize Symantec SSE? Dive into the full KuppingerCole report to further explore why Broadcom was named a quadruple Leader.

39:T47d,

Incident Prediction leverages known TTPs

SES-C amplifies its protection with Incident Prediction. Incident Prediction uses machine learning (ML) and AI to predict an attacker’s next four to five moves, giving SOC teams advance warning and ample time to respond and protect. This works well because, while attackers do evolve, they tend to rely on a more stable and predictable set of Tactics, Techniques and Procedures (TTPs). Trained on a catalog of over 500,000 attack chains, Incident Prediction knows these TTPs inside out and it passes that knowledge on to the SOC who need it.

Incident Prediction extends Adaptive Protection’s defensive power by giving it high-level intel to inform targeted policy changes. Together, these two features helped SES-C yield those 100% protection stats against a wide and ever-changing range of attacks.

3a:T12f1,

Endpoint security proven where it matters

At Broadcom’s Symantec and Carbon Black®, we’ve long believed that resilience in cybersecurity can’t (and shouldn’t) be measured by marketing claims alone. Tested, tried, and true isn’t just some marketing ploy. It’s the truth we live by.

That’s why our ongoing relationship with SE Labs matters. Their work champions a practical, evidence-based approach to cybersecurity testing, one designed to help defenders understand how security technologies perform against real-world threats. As Founder and CEO of SE Labs, Simon Edward explains, this award “reflects not only strong product performance in our tests but also the commitment of the teams behind the technology.”

And frankly, this means more to us than another trophy on the wall—it’s validation of a mutual belief that security should be proven, not promised. As our Frontier AI research explores, attackers are now using AI to discover and chain vulnerabilities at a scale and speed never before possible. The implications are clear: attackers are becoming more efficient and the window between disclosure and exploitation is swiftly shrinking.

In this new era, security vendors are responsible for putting proven technology in the hands of defenders that they can trust under pressure, whether they’re blocking AI-generated phishing and ransomware, detecting lateral movement, or surfacing Shadow AI, or connecting the signals that reveal how an attack is moving across the environment.

Not our first, but certainly not our last

Through years of recurring assessments, Symantec and Carbon Black solutions have consistently earned top marks from SE Labs, as well as recognition from respected independent evaluators including Radicati Group, and IDC. From AAA ratings in advanced endpoint protection to Google Cloud 2025 Partner of the Year in data security, our solutions lead the market with results organizations can depend on.

In 2025, both Symantec Endpoint Security and Carbon Black EDR earned high marks across rigorous evaluations designed by SE Labs to mirror real-world attacks, landing in the top 10%. Those results reflect the quality of protection, visibility, and resilience a tumultuous threat landscape demands. An honor we don’t take lightly.

Built for the next chapter of endpoint security

As proud as we are of this recognition, we know our work is far from over. That’s part of what makes this industry so demanding and so necessary. The threats keep moving, which means security has to keep proving itself.

This award honors the endpoint security portfolio we’ve spent years refining and perfecting. Now we’re taking the next step. Later this year, Broadcom is bringing together some of the industry’s most trusted endpoint security technologies into a single, unified experience. By combining Symantec’s award-winning prevention capabilities and Carbon Black’s pioneering EDR technology, Symantec CBX offers organizations of every size the cross-domain visibility and AI-powered advantage needed to keep up with today’s sophisticated threats—all in a single pane view.

It’s all part of our ongoing mission to make proven, enterprise-grade protection more accessible.

As always, we’re grateful to SE Labs for this recognition, and we’ll continue earning it the same way we always have: by building security solutions that prove their value where it matters most—in the hands of the SOCs that rely on them every day.

To try out enterprise-grade endpoint protection for your organization, request a demo with your in-region experts.

3b:T5f2,

The lives of security professionals would be much simpler if data were a neatly packaged monolith around which we can simply build a moat and raise the drawbridge. But that’s not reality. Data is more ephemeral. It cascades through SaaS apps, cloud infrastructure, and sprawling digital environments that have grown faster than organizations can keep up with. And while security investments have sought to keep pace with functions like endpoint, identity, and network protection, data itself quietly remains a part of the security stack that eludes easy understanding.

Data security practitioners are being asked to shore up leaky data and close this persistent gap between the intention to protect and the ability to execute effective data safeguards. Executives and boards want clarity and control, not guesswork or half-hearted reassurance. They want to know where their sensitive data lives, how it’s moving across the organization, and whether it’s exposed in ways that could introduce risk.

This challenge is what gave birth to the concept of data security posture, or the ability to enumerate, quantify, and visualize your data estate to understand its underlying risks.

While much of this risk comes from the way humans use data, AI agents working with your data at machine speed add an entirely new level of urgency to the need to be able to inspect data security posture—and ultimately to manage it.

3c:T408,

Knowledge + Action = Power

The industry principle here is fairly simple: You can’t protect what you don’t understand. Data security posture management (DSPM) removes the understanding barrier, enabling organizations to see their data estate as it truly exists: distributed, dynamic, and constantly evolving.

DSPM adoption keeps growing as more and more organizations shift security towards a data-centric model. Organizations seeking maximum protective impact are pairing DSPM with the proven power of data loss prevention (DLP). In this data protection power couple, DSPM provides added context (understanding the data, its sensitivity, and exposure) while DLP provides the control (the ability to enforce policies and protect data where it lives).

With these capabilities combined, users can better identify sensitive data, analyze risk, and implement the necessary controls to protect that data—no matter where it is or where it’s headed next.

3d:Ta45,

Symantec DLP Cloud and DSPM are better together

As pioneers in the DLP market, Symantec knows the best data protection combines context and control—and doesn’t add extra work for busy users. Symantec DSPM, available now as an add-on to Symantec DLP Cloud, allows businesses to see all of the data in their environment as a living ecosystem—delivering a clear and consolidated view of data across cloud environments, surfacing not only where data exists but also what it contains and why it matters.

In a one-stop dashboard, it illuminates critical information about the business’s data, including the distribution of data by source, encryption, user, tags, and more. It unearths key statistics of your data estate and provides high-level insights on data trends. Underlying all of this is a comprehensive catalog of known files, allowing users to see an enumerated list of monitored files along with attributes, classifications, tags, and additional detail.

This type of context is immensely valuable on its own. But Symantec DSPM’s catalog and data insight are made possible through our industry leading, enterprise-grade DLP detection techniques. This “better together” approach pairs visibility with meaningful action. It makes it possible to identify sensitive data like PII, PCI and PHI with a high degree of accuracy, while also understanding the regulatory implications tied to that data. Thanks to the combined powers of Symantec DSPM and Symantec DLP Cloud, organizations can begin to see how their critical data is exposed (through external sharing or simple neglect) and how specific user activity may contribute to risk over time.

Historically, achieving this level of deep data visibility that’s still digestible required significant effort, customization, and operational overhead. Symantec DSPM makes it possible to adopt this type of data-centric security model with far less friction, enabling more organizations to move beyond fragmented visibility and toward a cohesive understanding of their data estate.

Unified visibility and protection in a single platform delivers robust security across critical channels: endpoint, email, web apps and traffic, data centers, and in-tenant scanning. What’s more, this model eliminates the burden of facilitating DSPM and DLP as parallel installments, making it easy to deploy in large enterprises and at massive scale.

3e:T5df,

Enterprise-grade data security for all

Reducing friction is at the heart of our broader mission. We believe that enterprise-grade security should not be limited to a select few organizations with unlimited resources. The complexity of modern data environments affects every organization, regardless of size or maturity. The ability to understand and protect data should be equally accessible. Because, ultimately, we’re all in this together.

Symantec’s combination of DLP and DSPM into a single data security platform is a natural extension of our inclusive vision. It brings enterprise-grade data visibility, context, and control into reach, helping organizations take the first meaningful step toward a data-centric security strategy without requiring them to rebuild their security programs from the ground up.

The good news: You can protect what you do understand. And Symantec’s DLP-powered DSPM is ready to deliver transparent data insights and control you can trust. Learn more about the platform Symantec DSPM is built on, and contact your local partner to unleash DSPM.

3f:T736,

A fear of pioneers

In the heat of the current AI hype, every vendor is rushing to claim it as their own. But while others are slapping "Agentic AI" stickers on their one-pagers, Symantec and Carbon Black have been quietly running early iterations of AI-enhanced products and advanced machine learning models for well more than a decade. Why? Because we’re foundationally committed to better and innovation is in our DNA. We’re not laurel-resters or coat-tailers—we’re explorers and pioneers. And we’ve got the R&D budget to back it up.

That R&D focus means we’re not just another vendor hitching a ride on the AI bandwagon. We’re in the driver’s seat because we helped build the roads. Because we were piloting AI features long before it was omnipresent, CBX’s agentic AI capabilities are built on the strong foundation of Carbon Black's legendary EDR and backed by an unparalleled historical repository of over 500,000 real-world attack chains curated by the Symantec Threat Hunter Team.

And since we’ve been deploying ML systems longer than the upstarts currently clamoring for your attention, our AI is at the head of the class, with advanced level knowledge, leveraging that deep historical intelligence to mathematically predict the future and get there ahead of attackers.

40:T96b,

Predictors disrupt. Reactors remediate.

Let’s look at how Symantec CBX stacks up against the other highly marketed agentic AI solutions in the market. While both sides lean heavily into AI to reduce the workload on Security Operations Center (SOC) teams, they take remarkably different approaches to defending the enterprise.

The most glaring difference between CBX and other AI platforms is where the AI actually applies its analytical muscle.

Symantec CBX adopts a “strike first, strike hard” approach to preempting attacks.
It features an industry-first Incident Prediction capability powered in part by Google’s Gemini 2.5 Flash series of models.
Exhaustively trained on that massive historical attack chain repository, CBX mathematically predicts an attacker's next four to five moves.
CBX automatically blocks malicious actions before they execute—an absolute game-changer for stopping abuses of legitimate software for living off the land (LOTL) attacks. No mercy.

Some alternative AI platforms can be investigative and reactive, often focusing their AI entirely on hyper-automation and mirroring human triage after an alert has already fired. While automatically building narratives and tracking lateral movement is helpful for post-breach investigations, they end up resolving the immediate incident and drafting rules after the threat is already inside. Recovery after an attack is obviously vital. But what if you could preemptively predict an attacker’s next few moves–before you end up on the mat and fighting to get back up?

Think about it. Strategically deploying AI to block attacks before means you don’t have to worry about recovering after. What’s that saying about an ounce of prevention?

41:T86b,

CBX is built for the SOC trenches

While architectural differences are stark, the real magic of CBX happens in the trenches with the security operators. CBX is designed to shift defense to the "left" of the attack timeline. Because the Incident Prediction engine anticipates an adversary's actions and automatically disrupts the attack chain, it stops attackers before they can encrypt data or exfiltrate information. Even when an incident does require human eyes, CBX aggressively targets reducing the cognitive load that typically burns out SOC analysts. Instead of forcing operators to swivel between disjointed consoles to understand an attack, CBX deploys Threat Tracer. This unified interface visually maps an attacker's complete workflow—showing exactly how they entered and detailing precisely what they accessed across the network, endpoints, email, and cloud environments.

CBX's AI-generated Incident Summaries cut through busy work, sifting through mountains of event data to produce a clear, natural-language narrative in seconds. These summaries instantly outline the attack chain, highlight suspicious command lines, and immediately serve up suggested remediation steps for rapid, fully-informed action.

Combining Incident Prediction and Incident Summaries massively reduces post-incident labor. With CBX, AI efficiently handles the heavy lifting of manual triage and correlation, sparing analysts hours—or even days—of post-incident analysis. By drastically shrinking the Mean Time to Understanding (MTTU) and Mean Time to Acknowledge (MTTA), CBX gift wraps every operator’s most desired commodity: time.

42:T4fe,

Flexing our foundation

A second key difference between Symantec CBX and other solutions comes down to our inheritance. CBX is built on decades of innovation from two legendary brands.

Its fully agentic AI is able to map threats comprehensively, with a wealth of tools and security assets at its disposal.
CBX doesn’t need to waste time stitching together disparate third-party tools to give you an answer.
It simply pulls from Symantec and Carbon Black’s reputation databases, threat intelligence APIs, and network protections to deliver swift, reliable intel.

Some vendors spin their reliance on normalized third-party data as "data agnostic." But they’re reluctant to admit that they do this (often laborious and costly) work out of necessity, because they simply lack the deep, native ecosystem of endpoint, web, network, and data security controls that Symantec CBX inherently possesses.

43:T524,

The process nobody expects to touch LSASS

A process reaches into lsass.exe and reads its memory. Nothing crashes. No malware signature fires. The binary doing the reaching is signed by Microsoft and sitting exactly where it's supposed to be in System32. Is this a crash-reporting tool doing its job, or is this the moment every credential on that box just walked out the door?

The Local Security Authority Subsystem Service (LSASS) holds the credential material for every user who's logged onto that system. Domain passwords, Kerberos tickets, NTLM hashes, and other authentication data live in its memory while a session is active. If an attacker can read that memory, they don't need to guess a password or crack a hash. They can just take what's already sitting there.

That’s why this technique remains one of the most consistently used post-exploitation moves in the entire ATT&CK framework, from ransomware crews to nation-state operators.

Most people picture Mimikatz when they think about LSASS dumping: a purpose-built credential theft tool actively flagged by nearly every AV and EDR product on the market. But attackers have already moved on. The technique worth understanding this week doesn't need Mimikatz at all.

44:T48c,

The legitimate case

Comsvcs.dll is a real Windows component, containing a MiniDump export function for capturing process memory during crash diagnostics and troubleshooting. Legitimate memory dumps of various processes happen all the time in enterprise environments, driven by crash reporting tools, application performance monitoring, or a support engineer troubleshooting a hung process.

Here’s how to recognize a legitimate dump:

Target: A process related to an actual reported problem, rather than LSASS specifically, unless there's a documented, unusual reason to examine it
Creating context: Initiated by a recognized diagnostic tool or an administrator working on an an open ticket
Output: It produces a file that gets handled through normal IT workflows, reviewed, attached to a case, or discarded

45:T829,

The malicious case

The exact same Windows component (same exported function) can be invoked very differently when an attacker is after credentials.

Command line: rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> lsass.dmp full, specifically targeting the LSASS process ID
Parent process: This command rarely originates from a normal admin session. It shows up spawned from PowerShell, a script host, or a process chain that traces back to initial access activity
Output file: Lands somewhere it shouldn't like a temp directory or a user profile path rather than a location tied to any legitimate diagnostic workflow
Context: No supporting ticket, crash report, or other reason for LSASS to be dumped right at that moment

Attackers favor this method precisely because rundll32.exe and comsvcs.dll are both signed, both expected to exist, and neither one is inherently suspicious on its own. It's the same LOLBin logic that’s shown up in our previous walkthroughs: a trusted binary doing something it wasn't primarily built for, in a way that requires context to catch.

There’s also another variant worth knowing. Some attackers skip the direct dump entirely and abuse Windows Error Reporting instead. By manipulating the Image File Execution Options registry key tied to lsass.exe, they can trigger WerFault.exe to produce the memory dump for them through the silent process exit mechanism, avoiding the use of a dumping tool altogether. Same outcome, just different path in.

46:Td31,

Where the signal comes together

Manually, this investigation means correlating crossproc events against lsass.exe, filtering for OPEN_PROCESS_HANDLE or PROCESS_API_CALL actions with the specific DesiredAccess rights required to read process memory, such as NtReadVirtualMemory. Followed by chasing down the parent process and command line for anything that touched it. That's a real, learnable threat-hunting skill. It can also mean spending a fair amount of time pulling events together by hand before the picture becomes clear.

Threat Tracer surfaces that chain directly. Instead of manually correlating a cross-process event to a separate process-creation event and hoping they line up, analysts can see which process requested access to LSASS, what rights it asked for, and what spawned it in the first place. The work shifts from reconstructing a sequence from raw event logs to deciding whether the sequence belongs.

What to look for in Threat Tracer

Start with the process requesting access to LSASS and trace its parent.

A known diagnostic or monitoring tool with a clean, expected lineage reads very differently from rundll32.exe spawned by PowerShell or an unexpected script host. Then, look at what access was requested. Process memory read access is important here, especially when the target is LSASS (visible in the Crossproc details card) rather than some other process tied to a legitimate troubleshooting case.

Finally, check if a dump file gets written, generating a filemod event. Where it lands matters. A path outside any recognized diagnostic workflow, especially paired with a Crossproc chain that has no ticket or business reason behind it, is the combination worth escalating immediately.

A quick posture check

Before you close out, consider these questions about your own environment.

Would you notice if rundll32.exe requested memory access to lsass.exe on an endpoint right now, or would that blend into normal diagnostic noise for you?
Do you know what the legitimate crash-dump and diagnostic tooling actually looks like in your environment, well enough to rule it out quickly?
If Credential Guard isn't enabled across your fleet, do you know which systems are still exposed to direct LSASS memory reads?

Out of the three, the third may carry the most weight. Where Credential Guard is deployed, LSASS secrets are isolated in a protected container that this attack technique can't reach. Knowing where that protection is and isn't deployed is itself a posture decision, not just a detection one.

Next up, we'll look at another ATT&CK technique using the same approach: what's normal, what's not, and what can help you make that distinction faster.

To see how Symantec CBX helps analysts spend less time stitching together events, reach out for a 1:1 demo.

47:T736,

A fear of pioneers

In the heat of the current AI hype, every vendor is rushing to claim it as their own. But while others are slapping "Agentic AI" stickers on their one-pagers, Symantec and Carbon Black have been quietly running early iterations of AI-enhanced products and advanced machine learning models for well more than a decade. Why? Because we’re foundationally committed to better and innovation is in our DNA. We’re not laurel-resters or coat-tailers—we’re explorers and pioneers. And we’ve got the R&D budget to back it up.

That R&D focus means we’re not just another vendor hitching a ride on the AI bandwagon. We’re in the driver’s seat because we helped build the roads. Because we were piloting AI features long before it was omnipresent, CBX’s agentic AI capabilities are built on the strong foundation of Carbon Black's legendary EDR and backed by an unparalleled historical repository of over 500,000 real-world attack chains curated by the Symantec Threat Hunter Team.

And since we’ve been deploying ML systems longer than the upstarts currently clamoring for your attention, our AI is at the head of the class, with advanced level knowledge, leveraging that deep historical intelligence to mathematically predict the future and get there ahead of attackers.

The Detection Gap: MITRE ATT&CK T1003.001

The DLP Network Discover Cluster Is Always Watching (So Your Team Doesn't Have To)

6 Use Cases Security Practitioners Can Tackle With XDR

How To Take Prevention to the Web Layer

The Detection Gap: MITRE ATT&CK T1003.001

What Happens When Two Iconic Brands Unite?

Explore Upcoming Events