Back Feeds2.Feedburner

EDR killers are now standard equipment in ransomware attacks

Feeds2.Feedburner •Anamarija Pogorelec • March 19, 2026

Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild. The workflow is consistent across groups: an attacker gains high privileges, deploys an EDR killer to disrupt security software, then runs the encryptor. Affiliates prefer this approach because it gives them a brief, … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers Recent research from ESET reveals that ransomware attackers are increasingly using EDR killers to disable endpoint detection and response (EDR) systems before launching their encryptors. These tools have become standard in modern ransomware operations, with ESET tracking nearly 90 different EDR killers in active use. Attackers typically gain high privileges, deploy EDR killers to disrupt security software, and then execute the ransomware. The research highlights the growing complexity of these tools, which now include methods beyond the traditional Bring Your Own Vulnerable Driver (BYOVD) technique, such as script-based and driverless approaches. ESET emphasizes the need for organizations to enhance their defenses against these evolving tactics, as relying solely on blocking vulnerable drivers is insufficient. The study also notes that some EDR killers may exhibit traits of AI-assisted generation, complicating detection efforts. The findings underscore the necessity for a multi-faceted defense strategy against ransomware threats. 17 sources 70

Extracted Entities

EDR killers are now standard equipment in ransomware attacks

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)