August 27, 2024

Attack tool update impairs Windows computers

An EDR killer Sophos X-Ops has tracked for three years continues to bedevil organizations targeted by ransomware gangs.

Threat Research

August 14, 2024

Ransomware attackers introduce new EDR killer to their arsenal

Sophos discovers the threat actors behind RansomHub ransomware using EDRKillShifter in attacks

Threat Research

April 09, 2024

Smoke and (screen) mirrors: A strange signed backdoor

Sophos X-Ops discovers a curious backdoored (and signed) executable, masquerading as something else entirely

Threat Research

March 04, 2024

It’ll be back: Attackers still abusing Terminator tool and variants

First released in May 2023, an EDR killer – and the vulnerable Zemana drivers it leverages – are still of interest to threat actors, along with variants and ported versions

Threat Research

January 25, 2024

Multiple vulnerabilities discovered in widely used security driver

A false-alarm incident involving Panda Security software leads to three very real CVEs

Threat Research

April 19, 2023

‘AuKill’ EDR killer malware abuses Process Explorer driver

Driver-based attacks against security products are on the rise

Threat Research

December 13, 2022

Signed driver malware moves up the software trust chain

The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate

Security OperationsThreat Research

October 04, 2022

Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse

A fresh exploration of the malware uncovers a new tactic for bypassing security products by abusing a known driver vulnerability

Threat Research

May 04, 2022

Attacking Emotet’s Control Flow Flattening

Sweeping aside one obfuscation technique in a notorious strain of malware

Products & Services