#drivers

Analysis · May 20, 2026 · Colten Anderson

The ransomware that brought a signed driver to switch off the rule against unsigned drivers

In 2020, RobbinHood became the first ransomware seen shipping a legitimately-signed GIGABYTE driver, exploiting it to disable Windows driver-signature enforcement, then loading its own unsigned driver to kill security software from the kernel. The four GIGABYTE CVEs are why.