Tag: avkiller

4 Attack Reports | 0 Vulnerabilities

Attack reports

CrySome RAT : An Advanced Persistent .NET Remote Access Trojan

CrySome is a sophisticated .NET-based remote access trojan designed for persistent command-and-control operations. It features advanced persistence mechanisms, including recovery partition abuse and offline registry modification, allowing it to survive system resets. The malware incorporates an agg…

credential theft

defense evasion

Published: March 31, 2026

Downloadable IOCs: 2

Shared secret: EDR killer in the kill chain

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors,…

Published: August 7, 2025

Downloadable IOCs: 56

Legacy Driver Exploitation Through Bypassing Certificate Verification

A new security threat using the Legacy Driver Exploitation technique has been identified, focusing on remote system control via Gh0stRAT malware. The attack distributes malware through phishing and messaging apps, utilizing DLL side-loading for additional payloads. A modified TrueSight.sys driver b…

dll side-loading

padding manipulation

legacy driver exploitation

certificate verification

driver vulnerability

Published: March 18, 2025

Downloadable IOCs: 3

Medusa Ransomware Activity Continues to Increase

Medusa ransomware attacks jumped by 42% between 2023 and 2024. This increase in activity continues to escalate, with almost twice as many Medusa attacks observed in January and February 2025 as in the first two months of 2024.

Published: March 6, 2025

Downloadable IOCs: 45

Click here to see more Attack Reports