Attackers are using custom malware to exploit drivers and terminate security processes so they can deploy ransomware.