Malware - EDR Killers Become Standard in Ransomware Attacks
Basically, ransomware hackers use special tools to turn off security software before locking files.
Ransomware attackers are now using EDR killers to disable security software before encrypting files. This trend affects many organizations and highlights the need for improved defenses. As ransomware tactics evolve, proactive monitoring and robust controls are essential to protect against these threats.
What Happened
Ransomware attacks have evolved, with attackers now routinely deploying EDR killers to disable endpoint detection and response (EDR) software. This tactic allows them to launch their encryptors with minimal resistance. According to ESET Research, nearly 90 different EDR killers are actively being used in the wild. The typical workflow for these attacks involves gaining high privileges, deploying an EDR killer, and then executing the encryptor. This method provides a brief window for attackers to encrypt files without needing to constantly modify their payloads to evade detection.
Who's Being Targeted
In the world of ransomware-as-a-service, the division of labor is crucial. Operators provide the encryptor, while affiliates select the EDR killers. This approach leads to a greater diversity of EDR tools being used across different attacks. As a result, defenders face a wider array of EDR killers from a single ransomware brand, depending on which affiliate executed the attack. This complexity makes it more challenging for organizations to defend against such intrusions.
Signs of Infection
The most common method employed by attackers is the Bring Your Own Vulnerable Driver technique. This involves dropping a legitimate but vulnerable driver onto a victim's machine, which is then exploited to gain kernel-level access. However, a growing number of EDR killers can bypass this requirement entirely, using built-in administrative tools to disrupt EDR communication or suspend processes. Some of these tools even exhibit signs of AI-assisted development, complicating the threat landscape further.
How to Protect Yourself
To effectively defend against these evolving threats, organizations must implement proactive monitoring strategies. It's essential to focus on the stages of privilege escalation and driver installation, as these are critical points where EDR killers can be deployed. Blocking vulnerable drivers is a necessary step, but it is not sufficient on its own. Organizations need comprehensive controls to disrupt EDR killers before they can load, ensuring a more robust defense against ransomware intrusions.
As ransomware continues to adapt and evolve, defenders must prioritize resources and design detection strategies that account for the interactive and human-driven nature of these operations.