EDR Killer

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

• Malware

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

Do Son August 27, 2026 0

eSentire ties the Cruciferra malware loader to ClickFix EDR killer attacks that abuse a signed driver to stop 145 security processes.

Qilin’s “EDR Killer” Dismantles 300+ Security Drivers

• Malware

Qilin’s “EDR Killer” Dismantles 300+ Security Drivers

Do Son April 9, 2026 0

Cisco Talos unmasks a Qilin ransomware payload that terminates 300+ EDR drivers and manipulates the Windows kernel. See how this "EDR Killer" stays invisible.

The Resume Trap: How ‘BlackSanta’ Malware Uses Fake CVs to Blind EDRs and Hijack HR Systems

• Malware

The Resume Trap: How ‘BlackSanta’ Malware Uses Fake CVs to Blind EDRs and Hijack HR Systems

Do Son March 18, 2026 0

Aryaka Threat Labs exposes BlackSanta, a Russian-linked malware targeting HR teams with fake resumes to deploy an EDR-killer and steal crypto wallets.

GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes

• Malware

GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes

Do Son December 12, 2025 0

GOLD BLADE (RedCurl) targets Canadian firms (80% of attacks) with espionage and QWCrypt ransomware. The group uses fake resumes and a BYOVD EDR killer (Zemana driver) to disable security controls.

Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks

• Malware

Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks

Do Son December 11, 2025 0

Makop ransomware operators now use GuLoader and BYOVD (ThrottleStop.sys) to bypass EDR and security. The "low-effort" campaign targets RDP-exposed networks, with 55% of attacks aimed at India.

DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass

• Malware

DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass

Do Son December 11, 2025 0

DeadLock Ransomware uses BYOVD (Baidu driver exploit) and the EDRGay.exe loader to kill EDR/AV at the kernel level. It uses a custom stream cipher and deletes shadow copies to prevent recovery.

Shanya Crypter Is the New Ransomware Toolkit: Uses Kernel Driver Abuse to Kill EDR

• Malware

Shanya Crypter Is the New Ransomware Toolkit: Uses Kernel Driver Abuse to Kill EDR

Do Son December 9, 2025 0

The Shanya Crypter (VX Crypt) is a new PaaS used by Akira/Medusa to bypass EDR. It deploys a kernel driver attack to kill security products and uses PEB manipulation for stealth.

New TangleCrypt Packer Hides EDR Killer, But Coding Flaws Cause Ransomware to Crash Unexpectedly

• Malware

New TangleCrypt Packer Hides EDR Killer, But Coding Flaws Cause Ransomware to Crash Unexpectedly

Do Son December 1, 2025 0

WithSecure exposed TangleCrypt, a new ransomware packer that uses LZ78/XOR and embedded PE resources to hide the STONESTOP EDR killer. However, coding flaws cause unexpected crashes.

Poortry EDR Killer Evolves, Now Wipes Security Software From Windows Systems

• Malware

Poortry EDR Killer Evolves, Now Wipes Security Software From Windows Systems

Do Son August 27, 2024 0

Explore the threat of Poortry: a malicious toolset designed to undermine endpoint detection and response (EDR) software on Windows systems. Learn how it bypasses security measures and adapts to evade detection.