EDRKillShifter is an EDR-killer loader first documented by Sophos in August 2024 after it surfaced in a May 2024 RansomHub intrusion. Its job is to disable endpoint detection and response so ransomware can run unobstructed, and it does so through Bring Your Own Vulnerable Driver (BYOVD): the loader decrypts and drops a legitimate but vulnerable signed Windows kernel driver, loads it as a service, and abuses the driver’s kernel-level access to terminate security processes from a privilege level that user-mode protections cannot stop. Built by or for RansomHub and handed to its affiliates, it was later observed by ESET in intrusions tied to Play, Medusa and BianLian — a notable case of cross-gang tool sharing.
Overview & Timeline
- May 2024. Deployed in a RansomHub attack investigated by Sophos; the follow-on ransomware was blocked by Sophos CryptoGuard, and the tool was discovered during that investigation.
- 14 August 2024. Sophos published its naming and analysis.
- March 2025. ESET reported the same tool appearing in Play, Medusa and BianLian intrusions, corroborated by SecurityWeek, The Hacker News and SC Media.
Sophos assessed with moderate confidence that multiple distinct actors use the tool. The binary carried Russian-language build settings and was disguised with metadata mimicking a well-known game — weak, circumstantial signals, not conclusive attribution. ESET’s reading is that a trusted actor repurposed RansomHub’s tooling across rival operations, which links the gangs through shared tooling rather than proving a shared operator.
How It Works
- Password-gated loader. EDRKillShifter is a loader, not the ransomware. The operator must supply a password on the command line; only then does it decrypt its embedded encrypted resource and run the payload in memory. The gate also frustrates sandbox analysis. T1027
- Go payload. Per Sophos, the decrypted payload is written in Go and drops one of several legitimate but vulnerable drivers — the specific driver varies by build.
- Driver as a service. The vulnerable driver is installed and its service loaded, giving the malware kernel-level primitives. T1543.003 T1068
- Kill loop. It then runs a continuous loop, enumerating processes and terminating any whose name matches a hardcoded list of security and EDR products — kills that user-mode tools would block. T1562.001
- Acquired capability. Affiliates obtain the shared tool rather than building their own. T1588.002
Windows loads kernel drivers that carry a valid signature even when the driver contains an exploitable flaw. Attackers “bring” such a signed vulnerable driver, load it, and use its primitives — arbitrary process termination, kernel memory read/write — to disable security tooling. The technique has grown markedly more common in ransomware since 2022, which is why Microsoft maintains a Vulnerable Driver Blocklist.
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Defense Evasion | T1562.001 Disable or Modify Tools | Terminating EDR and AV processes |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation | Abusing the vulnerable driver’s kernel flaw |
| Persistence | T1543.003 Windows Service | Loading the vulnerable driver as a service |
| Defense Evasion | T1027 Obfuscated Files or Information | Encrypted resource, self-modifying code |
| Resource Development | T1588.002 Obtain Capabilities: Tool | Affiliates acquiring the shared killer |
| Impact | T1486 Data Encrypted for Impact | The ransomware the killer enables |
Detection Signals
Specific driver filenames, service names and file hashes for EDRKillShifter should be taken from the Sophos and ESET IOC appendices, not from secondary summaries. The behavioural signals below are the durable detections.
- A newly written signed driver registered as a kernel service immediately before mass security-process termination. Watch Sysmon Event ID 6 (driver load) and Event ID 7045 (new service install).
- A short-lived executable run with a command-line argument that looks like a password or token, followed by EDR and AV processes terminating en masse or the agent going silent.
- Self-deleting or self-modifying loader behaviour.
- EDR agent health alerts — an agent going offline unexpectedly is a signal in its own right.
Detection & Mitigation
- Enforce the Microsoft Vulnerable Driver Blocklist and verify it is active; enable HVCI / Memory Integrity. Use WDAC and community blocklists (loldrivers.io) to block known-vulnerable drivers.
- Enable tamper protection on EDR and AV so agents cannot be silently stopped, and alert when an agent goes offline.
- Restrict driver loading and monitor for unsigned or anomalous driver loads and new kernel services.
- Deny local admin. BYOVD requires administrative rights to install a driver; least privilege largely defeats it.
- Keep anti-ransomware rollback layers in place for defense-in-depth when a killer partially succeeds.
Stop Attackers From Blinding Your Defenses
Mjolnir Security helps organisations detect BYOVD and EDR-killer activity before ransomware detonates.
- Managed Detection and Response Continuous monitoring for vulnerable-driver loads, new kernel services and EDR agents going dark.
- Threat Hunting as a Service Proactive hunting for BYOVD precursors and the loader behaviours that precede ransomware deployment.
- 24/7 Incident Response Containment and forensic analysis when defense-evasion or ransomware activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts