Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors, and uses a driver with a compromised certificate to terminate processes and services. The report details the tool's characteristics, its connection to ransomware attacks, and provides examples of its use in specific ransomware families. Notably, the report highlights evidence of tool sharing and technical knowledge transfer among competing ransomware groups, suggesting a more complex ecosystem than previously thought.

The threat described, known as AVKiller, is a sophisticated malware tool specifically designed to disable Endpoint Detection and Response (EDR) systems on compromised hosts. AVKiller has been observed in multiple ransomware campaigns since 2022, indicating its active use in the wild by various ransomware groups. The tool operates by leveraging a malicious driver signed with a compromised certificate, allowing it to terminate critical security processes and services stealthily. This capability effectively neutralizes endpoint security defenses, enabling ransomware payloads to execute with reduced risk of detection or interruption. AVKiller targets a broad range of security vendors, demonstrating a high level of adaptability and technical sophistication. The malware is heavily protected, likely employing obfuscation and anti-analysis techniques to evade detection and reverse engineering. The report also highlights an ecosystem of threat sharing and technical knowledge transfer among competing ransomware groups, suggesting that AVKiller or its components are shared or sold within underground markets, increasing its proliferation and complicating attribution. The tactics employed by AVKiller align with multiple MITRE ATT&CK techniques, including process injection, masquerading, disabling security tools, and use of signed drivers to bypass security controls. Although no specific affected software versions or patches are listed, the presence of a compromised certificate and driver-based approach indicates a high level of sophistication and persistence. The lack of known exploits in the wild for this tool suggests it is primarily deployed post-compromise as part of the ransomware kill chain rather than as an initial attack vector.

Detailed information about Shared secret: EDR killer in the kill chain. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'brave prince - s0252'

Filter Threats

Threats Tagged 'brave prince - s0252'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility