Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers

Recent research from ESET reveals that ransomware attackers are increasingly using EDR killers to disable endpoint detection and response (EDR) systems before launching their encryptors. These tools have become standard in modern ransomware operations, with ESET tracking nearly 90 different EDR killers in active use. Attackers typically gain high privileges, deploy EDR killers to disrupt security software, and then execute the ransomware. The research highlights the growing complexity of these tools, which now include methods beyond the traditional Bring Your Own Vulnerable Driver (BYOVD) technique, such as script-based and driverless approaches. ESET emphasizes the need for organizations to enhance their defenses against these evolving tactics, as relying solely on blocking vulnerable drivers is insufficient. The study also notes that some EDR killers may exhibit traits of AI-assisted generation, complicating detection efforts. The findings underscore the necessity for a multi-faceted defense strategy against ransomware threats.

Key Points: • EDR killers are now standard tools in ransomware attacks, with nearly 90 variants tracked. • Attackers use EDR killers to disable security systems before launching ransomware encryptors. • New tactics include script-based and driverless approaches, complicating detection and defense.