Tag: edr killer

3 Attack Reports | 0 Vulnerabilities

Attack reports

They Got In Through SonicWall. Then They Tried to Kill Every Security Tool

In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This …
byovd
edr killer
sonicwall
2026-02-04
driver signature enforcement
encase
guidance software
kernel driver
sslvpn
Published: February 4, 2026
Downloadable IOCs: 2

Inside Shanya, a packer-as-a-service fueling modern attacks

The Shanya crypter is a new packer-as-a-service offering gaining popularity among ransomware groups. It features advanced capabilities like non-standard module loading, unique stubs for each customer, AMSI bypass, anti-VM measures, and runtime protection. Early samples contained revealing artifacts…
ransomware
evasion
dll sideloading
medusa
stealc
akira
qilin
lumma
crypter
bumblebee
edr killer
packer-as-a-service
crytox
castlerat
2025-12-07
chuchuka
wht downloader
Published: December 7, 2025
Linked vulnerabilities : CVE-2022-26134, CVE-2023-3519, CVE-2022-3236, CVE-2022-30190, CVE-2020-15069, CVE-2018-0798, CVE-2023-40044
Downloadable IOCs: 5

Embargo ransomware: Rock'n'Rust

ESET researchers have uncovered new Rust-based tools used by the Embargo ransomware group. The toolkit includes MDeployer, a loader that deploys MS4Killer and Embargo ransomware, and MS4Killer, an EDR killer that exploits a vulnerable driver. Embargo, first observed in June 2024, is a relatively ne…
ransomware
rust
byovd
raas
2024-10-23
embargo ransomware
edr killer
safe mode abuse
ms4killer
mdeployer
Published: October 23, 2024
Downloadable IOCs: 0
Click here to see more Attack Reports