BYOVD EDR-killer tooling industrialized into a shared supply chain used by rival ransomware crews and RaaS affiliates

Linha do tempo

1. sentinelone.com ↗ · pub. 13/10/2026 13:18 · coletado 19/10 17:57 primeiro registro

   BYOVD EDR-killer tooling industrialized into a shared supply chain used by rival ransomware crews and RaaS affiliates

   ler a análise desta fonte ocultar

   This SentinelOne analysis argues that EDR killing, mostly through bring your own vulnerable driver (BYOVD), has grown from one-off tooling into a maintained, shared and sold capability. Ransomware actors disabled security tools in about 48% of 2024 intrusions, and BYOVD is the fastest-growing method within that figure. The article traces a timeline from Terminator (sold by Spyboy) and FIN7's AvNeutralizer/AuKill, through EDRKillShifter in RansomHub, to 2026 operator-run kits such as the Gentlemen RaaS framework. Its main thesis is acceleration and consolidation, not new origination: rival crews now share one supplier, which lowers the skill floor and the cost of defeating EDR. The piece also contains detection guidance and SentinelOne product promotion.

   Technical Details

   • AvNeutralizer/AuKill, attributed by SentinelLABS to FIN7 and sold for $4,000-$15,000, abused a Time Travel Debugging driver and the Process Explorer driver. It spread to Black Basta, AvosLocker, MedusaLocker, BlackCat, Trigona and LockBit operations.
   • Terminator (Spyboy, $300-$3,000) abused Zemana drivers. EDRKillShifter (August 2024, first seen in RansomHub) abused the RentDrv2 and ThreatFireMonitor drivers.
   • Akira affiliates in SonicWall VPN intrusions chained the ThrottleStop driver rwdrv.sys with the helper hlpdrv.sys to disable Windows antivirus. Qilin was seen chaining the same pair in April 2026 to remove EDR kernel callbacks across more than 300 products.
   • DeadLock abused the Baidu antivirus driver BdApiUtil (CVE-2024-51324). Reynolds ransomware embedded the NSecsoft driver NSecKrnl (CVE-2025-68947) to terminate more than 30 security processes, and Warlock also used NSecKrnl.
   • The Gentlemen RaaS ships an in-house EDR killer with eight-plus BYOVD variants, targeting over 400 processes across 48 security products via DeviceIoControl. It reportedly offers affiliates a ~90% revenue share and bundles HexKiller and ThrottleBlood.
   • Other observed traits: distinct per-attack packed builds, drivers masquerading as legitimate EDR drivers, stolen or revoked certificates, and 'driver decoupling' (installing and confirming the driver loads before running the killer).
   • Driverless alternatives include EDR-Freeze (suspends the sensor via a Windows error-reporting race) and EDRSilencer (Windows filtering rules block telemetry). Neither produces driver-load events.
   • Detection observables: Sysmon Event ID 1 (sc.exe service creation), System Event ID 7045 (service install), Sysmon Event ID 6 (driver load), System Event ID 7031 (service crash), and driver loads with a signature status other than Valid or with a first-seen hash, signer or version. Other signals are repeating fixed-interval process-enumeration and kill loops, kernel callback removal while the agent still reports healthy, and loss of agent heartbeat or telemetry.

   Remediation

   • Alert on driver loads that are not validly signed or are first-seen on a host, and correlate the service-creation, driver-load, DeviceIoControl and process-termination chain.
   • Hunt separately for kernel callback removal, and alert on the absence of expected agent telemetry or heartbeat, as well as Event ID 7031 for security services.
   • Cover driverless tamper techniques (EDR-Freeze, EDRSilencer) and use network, identity and cloud telemetry to catch activity after the sensor is silenced.
   • Restrict driver access controls and use vulnerable-driver blocklists and the LOLDrivers catalogue as references. Pivot on driver hashes to group campaigns by supplier rather than by gang.