Ankura CTIX FLASH Update - August 16, 2024

Malware Activity

New EDR-killing Utility Deployed with Ransomhub Ransomware

Researchers at Sophos have recently encountered a new malware developed to terminate EDR (Endpoint Detection and Response) processes in an attack using Ransomhub ransomware. Sophos has termed the new utility "EDRKillShifter", and believes the tool is being used by multiple threat actors. EDRKillShifter is a loader executable: a delivery mechanism for a legitimate driver vulnerable to abuse ("bring your own vulnerable driver", BYOVD). EDRKillShifter is first executed via command line with a password string, decrypting and executing a BIN resource in memory. The BIN code then unpacks and executes the final payload, which is written in Go and can exploit one of many different vulnerable drivers to gain privileges to unhook the EDR protection. Sophos observed different variants of EDRKillShifter which relied on two (2) different legitimate yet vulnerable drivers for privilege escalation.