Ransomware Attacks Now Rely on EDR Bypass Tools as Standard Tactic

Post Views: 9

Ransomware Attackers Increasingly Rely on EDR Killers to Evade Detection

Ransomware attackers have begun to regularly deploy tools designed to disable endpoint detection and response (EDR) software, allowing them to carry out their attacks without being detected. These tools, known as EDR killers, have become a standard component of ransomware intrusions, according to research by ESET.

The Use of EDR Killers

The use of EDR killers is a deliberate tactic employed by attackers to create a brief window of opportunity to complete the encryption process without being detected. By disabling EDR software, attackers can avoid having to continuously modify their payloads to evade detection, making the process more efficient and reliable.

Ransomware-as-a-Service Operations

In ransomware-as-a-service operations, the selection of EDR killers is typically left to affiliates, while operators provide the encryptor and supporting infrastructure. This division of labor results in a diverse range of EDR killer tools being used by different affiliates, making it more challenging for defenders to detect and respond to attacks.

Methods Used by EDR Killers

The most common method used by EDR killers is the Bring Your Own Vulnerable Driver (BYOVD) technique, which involves dropping a legitimate but vulnerable driver onto a victim machine, installing it, and then running malware that exploits the driver’s vulnerability to gain kernel-level access. However, a growing number of EDR killers are using alternative methods that do not require kernel access, instead interfering with EDR communication or suspending processes to bypass detection.

Other Techniques Used by EDR Killers

Some EDR killers have also been found to use built-in administrative tools and commands, requiring no specialized driver or kernel access. This simplicity makes them easy to develop and deploy, but also highlights the need for defenders to prioritize blocking vulnerable drivers and monitoring for suspicious activity.

The Use of AI-Assisted Code Generation

The use of AI-assisted code generation is also becoming more prevalent in EDR killer development, making it increasingly difficult to distinguish between human-written and AI-generated code. This trend is expected to complicate the threat landscape and make attribution more challenging.

Defender Adaptation

Defenders must adapt their approach to detecting and responding to ransomware attacks, which are interactive and human-driven operations that require continuous adaptation to detections, tool failures, and environmental conditions. Proactive monitoring at the privilege escalation and driver installation stages is critical to detecting EDR killer activity before an encryptor is deployed.

A Different Defensive Approach

The use of EDR killers in ransomware attacks highlights the need for a different defensive approach, one that prioritizes proactive monitoring and detection over traditional security controls. By understanding the tactics and techniques used by attackers, defenders can improve their chances of detecting and responding to ransomware attacks effectively.

According to ESET, the use of EDR killers has become a standard component of ransomware intrusions.

EDR killers are used to disable endpoint detection and response (EDR) software, allowing attackers to carry out their attacks without being detected.
The use of EDR killers is a deliberate tactic employed by attackers to create a brief window of opportunity to complete the encryption process without being detected.
Defenders must adapt their approach to detecting and responding to ransomware attacks, which are interactive and human-driven operations that require continuous adaptation to detections, tool failures, and environmental conditions.