Back Gbhackers

Windows Tools Abused to Kill AV Ahead of Ransomware Attacks

Gbhackers •Mayura Kathir • March 31, 2026

Hackers are increasingly turning legitimate Windows administration tools into stealthy weapons to disable antivirus and EDR before launching ransomware, making attacks faster, quieter, and harder to stop. Instead of dropping noisy custom malware upfront, modern operators chain trusted utilities to gain SYSTEM access, kill security processes, and then encrypt at scale. Because many of these […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers Recent research from ESET reveals that ransomware attackers are increasingly using EDR killers to disable endpoint detection and response (EDR) systems before launching their encryptors. These tools have become standard in modern ransomware operations, with ESET tracking nearly 90 different EDR killers in active use. Attackers typically gain high privileges, deploy EDR killers to disrupt security software, and then execute the ransomware. The research highlights the growing complexity of these tools, which now include methods beyond the traditional Bring Your Own Vulnerable Driver (BYOVD) technique, such as script-based and driverless approaches. ESET emphasizes the need for organizations to enhance their defenses against these evolving tactics, as relying solely on blocking vulnerable drivers is insufficient. The study also notes that some EDR killers may exhibit traits of AI-assisted generation, complicating detection efforts. The findings underscore the necessity for a multi-faceted defense strategy against ransomware threats. 18 sources 70

Extracted Entities

Windows Tools Abused to Kill AV Ahead of Ransomware Attacks

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)