Shared secret: EDR killers in the kill chain

Shared secret: EDR killers in the kill chain

Speakers: Gabor Szappanos, Principal Researcher, Sophos; Steeve Gaudreault, Principal Threat Researcher, Sophos

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=Ywfn-2xwI4Y

Overview

In this insightful presentation, Gabor Szappanos, representing joint work with Steeve Gaudreault, delves into the critical role of EDR killers within modern ransomware attack chains. Moving beyond the traditional "AV killers" moniker, Szappanos highlights how threat actors, particularly ransomware groups, have evolved their tactics to neutralize endpoint detection and response (EDR) solutions that have become highly effective at thwarting their operations. The talk explores the prevalence and technical intricacies of these EDR evasion tools, revealing patterns in their usage that shed light on the interconnectedness and operational transitions among various ransomware organizations.

The core of the research presented involves a detailed examination of two prominent EDR killer families, dubbed "ScorchChart" and "ShaDon" for the purpose of the presentation, along with the packer-as-a-service offerings that facilitate their distribution. Szappanos also unveils a previously undocumented EDR disabling technique that leverages legitimate disk management software to bypass security products without triggering traditional kill-chain detections. By analyzing overlaps in tool usage and methodologies, the speakers provide valuable insights into the fluid nature of ransomware groups, suggesting shared knowledge, affiliate migration, and even entire operation transitions between different ransomware families.

This analysis is particularly crucial for cybersecurity defenders, offering a deeper understanding of the preparatory stages of ransomware attacks. The findings underscore the continuous cat-and-mouse game between security vendors and threat actors, emphasizing the need for robust, multi-layered defenses that account for sophisticated evasion techniques, including those operating at the kernel level and those that exploit legitimate system functionalities.

Background

▶ Watch: Introduction: Why EDR killers matter (0:00)

The landscape of ransomware attacks has significantly matured, with the execution of the ransomware payload often being the culmination of an extensive preparation phase. As Gabor Szappanos noted, this observation dates back at least five years, to a previous VB Localhost presentation with his colleague Vikas, which explored the days and hours preceding a ransomware attack. In recent years, a critical component of these pre-attack kill chains has become the deployment of EDR killers. This rise in EDR killer usage is a direct response to the increasing effectiveness of modern security products; despite common misconceptions, EDR solutions are quite adept at stopping ransomware, a fact well-understood by threat actors.

Ransomware operators employ two primary strategies to circumvent EDRs: either they seek out unprotected devices within a compromised network for remote encryption of shared drives, or they actively deploy EDR killers to stop and eliminate security processes and services on target systems. To understand the connections and transitions between ransomware groups in this context, Szappanos leveraged external research and data.

One significant reference was ESET's research on EDRKillShifter, a proprietary tool of the RansomHub ransomware group. ESET found that unique samples of EDRKillShifter, tightly controlled via a build server, migrated across various ransomware operations over time, appearing in Medusa, RansomHub, Balia, and Play attacks. This suggested a direct link or shared resource among these groups. Another crucial piece of prior work came from Korson Carmichael, who analyzed data leak logs from ransomware data leak sites. By observing unique volume ID numbers generated by the dir command in directory listings, Carmichael identified overlaps indicating that the same affiliates were working for different ransomware operations. For example, SafePay affiliates showed overlaps with INC, Links, BlackSuit, and LockBit, illustrating a web of interconnected activities driven by shared personnel. These external findings laid the groundwork for Szappanos's own investigation into the EDR killer landscape, providing an initial map of ransomware group relationships and transitions.

Key Findings

▶ Watch: First EDR killer: 'Scorchchart' (Hardcript packer) (8:40)

The research uncovered several critical findings regarding the evolution and interconnectedness of EDR killer usage within ransomware operations:

1. Two Dominant EDR Killer Families Identified: The study detailed two distinct EDR killer families, temporarily named ScorchChart and ShaDon by the presenter. These families represent sophisticated approaches to disabling security products.
2. Prevalence of Packer-as-a-Service: Both EDR killer families were found to be distributed via commercial packer-as-a-service (PaaS) offerings. ScorchChart utilized HardCrypt, while ShaDon was associated with Shaa. These PaaS solutions provide attackers with ready-to-use obfuscation and evasion capabilities, lowering the barrier to entry for deploying malicious tools.
3. Kernel-Level Evasion: Both ScorchChart and ShaDon heavily rely on malicious kernel drivers to achieve their objectives. These drivers often leverage compromised digital signatures (including expired or revoked ones) or exploit legitimate, vulnerable drivers to gain privileged access and disable EDR components.
4. Operator/Operation Transition vs. Affiliate Sharing: Analysis of EDR killer sample hashes revealed minimal overlap between different ransomware groups using the same killer family (except for known closely related groups like Links and INC). This suggests that rather than individual affiliates sharing copies of the tool, entire ransomware operators or operations are transitioning between different ransomware families, taking their tooling and expertise with them. This implies a deeper, more structural connection or evolution among groups.
5. Discovery of a Novel, Undocumented EDR Evasion Technique: A significant finding was the identification of a unique EDR evasion method that does not involve killing processes or stopping services. This technique utilizes legitimate disk management software to move EDR components to a newly created disk volume, effectively disabling the security product upon reboot without triggering traditional tamper detections. This method was observed in attacks by RansomHub, SafePay, Links, INC, Play, and Akira, and notably, no public references to this technique were found, suggesting it's a "shared secret" or specialized knowledge among closely connected groups.
6. Complex Interconnections Among Ransomware Groups: The observed overlaps in EDR killer usage and the novel evasion technique reinforce the idea of a highly interconnected ransomware ecosystem. While some connections are clear (e.g., BlackSuit affiliates moving to Chaos and INC), others remain perplexing (e.g., the ubiquitous presence of KillNet, or the closed affiliate models of SafePay and Balia contradicting tool sharing). This highlights the challenges in fully mapping the intricate relationships within the ransomware landscape.

Technical Deep Dive

▶ Watch: Second EDR killer: 'Shaadon' (Shaa packer) (17:30)

The talk provided a deep dive into the technical mechanisms of the identified EDR killers and their associated packer services, alongside a novel evasion technique.

HardCrypt Packer-as-a-Service

The investigation began with HardCrypt, a packer-as-a-service identified by Unit 42 researchers. This service is actively promoted on underground forums and Telegram channels, costing approximately $20 per packed sample. Sophos observed over 2,000 files packed with HardCrypt. Its modus operandi involves taking a legitimate binary from a known software developer (abusing binaries from about 230 different vendors), injecting a loader code, and embedding an encrypted payload as a resource. The most common payloads distributed via HardCrypt included various initial access malware such as Raccoon Stealer, Remcos RAT, Lumma Stealer, other credential stealers, and remote access trojans (RATs), alongside the EDR killer dubbed ScorchChart.

ScorchChart EDR Killer

The first EDR killer family discussed, ScorchChart, was typically distributed via HardCrypt. It possessed heavily protected code and was designed to drop a malicious driver with a random five-letter name. This driver was often signed with a compromised digital signature from "Changa Hiang Information Technology Limited." Initially, it used an expired signature from 2011, which attackers bypassed by backdating the system time for the driver's load process. Later, they switched to a new signature after the first was revoked. A key observation, also noted in other research, is the benefit of drivers signed before July 2015, as these predate Microsoft's mandatory content signing enforcement, simplifying their deployment.

ScorchChart's driver-based approach allowed it to kill processes, stop services, and delete files within the installation directories of targeted antivirus solutions. Initially, it specifically targeted Sophos and HitmanPro products. However, later variants expanded their scope significantly, simultaneously targeting products from vendors like ESET, Symantec, Webroot, and Kaspersky. Across different samples, ScorchChart was found to target at least 15 different security products.

Other publications have referred to this driver as Abby worker (Elastic), PoorTry, or BurntCigar. A typical attack scenario involved the deployment of ScorchChart, immediately followed by ransomware execution, such as Medusa. A notable instance involved ScorchChart running from a regrep remote directory, a component of SimpleHelp, indicating rapid exploitation of a zero-day remote code execution vulnerability in SimpleHelp that was publicly disclosed weeks prior. ScorchChart has been observed in attacks attributed to BlackSuit, RansomHub, Medusa, KillNet, DragonForce, Krytox, Links, INC, and Cicada. Interestingly, analysis of hashes for different ScorchChart variants showed no overlap in usage between different ransomware operations (except for the closely related Links and INC), suggesting that those building these samples had access to the killer's source code, allowing them to customize the list of targeted security products. This points towards an operator or entire operation transitioning between ransomware groups, rather than affiliates simply reusing binaries.

Shaa Packer-as-a-Service

The newer Shaa packer-as-a-service emerged as a replacement for HardCrypt, with groups migrating to it. The name "Shaa" originated from early samples containing rich debugging information, including an executable name like "Shaa crypto." Further evidence included DLL versions with a specific structure: a morphed "Shaa" section, a section indicating its purpose (bypassing EDR detections), and a random DLL name section. Cyber Attack Solutions reported Shaa (calling it Army Loader) distributing various malware families like Bumblebee, Chuchuka, Lumma Stealer, WHD Downloader, CLC Stealer, and Casterat, in addition to a new EDR killer. Advertisements on the XSS underground forum for "VX script" by a developer named "Shaa" (contactable via Telegram handle Shaa0xFF) further corroborated its identity, listing capabilities such as non-start loading in memory, unique stub generation, MC bypass, runtime protection, and sideloading scenarios.

ShaDon EDR Killer

The EDR killer associated with Shaa, dubbed ShaDon, was primarily observed in DLL sideloading scenarios. For example, a clean legitimate loader (e.g., a Constantex Microsoft program) would load a malicious DLL (e.g., MSMG32DL). ShaDon would then drop two kernel drivers: a vulnerable legitimate driver (from TechPowerUp) and a malicious kernel driver. The malicious driver would leverage the vulnerable driver to gain write access to kernel structures it should not have, allowing it to traverse the loaded driver list and process list to stop targeted security components. ShaDon was seen in ransomware incidents involving Medusa, KillNet, Krytox, and most commonly, Akira, often exploiting remote code execution vulnerabilities. Similar to ScorchChart, analysis indicated no overlap in ShaDon samples between different operations, reinforcing the theory of operator or operation transition.

Novel EDR Evasion: The Disk Management Trick

A particularly alarming finding was a previously undocumented method of disabling EDR products without killing any processes or stopping any services. This technique, observed in RansomHub, SafePay, Links, INC, Play, and Akira attacks, involves using legitimate disk management software (from a popular security suite, though the specific product was not named) in a multi-step process:

1. The attacker uses the disk management software to split the active volume into two, creating a new volume.
2. Crucially, they configure the software to move the EDR product's directories, including its core components and virus database, from the original volume to the newly created one.
3. Upon system reboot, the disk management solution's kernel driver loads very early in the boot process, before the EDR's protection drivers can activate.
4. The new partition is created, and the files are moved. When the EDR attempts to load, its shortcuts and registry settings still point to the original location on the old volume, which is now empty. Consequently, the EDR fails to start, effectively disabling protection without any process termination or service stoppage that would typically trigger alerts.

This "knowledge" based evasion, unreferenced in public forums or threat intelligence, strongly suggests either direct personal overlap or very close, friendly connections between the ransomware groups employing it, further highlighting the complex, often hidden, interdependencies within the ransomware ecosystem.

Demo / Proof of Concept

▶ Watch: How volume management bypass disables protection (26:00)

The talk primarily focused on the analysis of observed attacks and techniques discovered through forensic investigation and threat intelligence, rather than a live demonstration or proof of concept of the EDR killers or evasion methods. The speaker detailed the mechanisms, deployment methods, and observed outcomes based on real-world incidents encountered by Sophos and other security researchers.

Defensive Implications

▶ Watch: Shared knowledge of EDR bypass: Strong group links (28:00)

The revelations from this talk provide critical insights for bolstering defenses against modern ransomware attacks:

1. Enhanced Driver Integrity Monitoring: Defenders must implement robust mechanisms to monitor and validate all loaded kernel drivers. This includes scrutinizing drivers signed with expired or revoked certificates, especially those predating July 2015, and actively blocking any unsigned or suspicious drivers. EDRs and host integrity monitoring systems should have strong capabilities to detect and prevent unauthorized driver installations or modifications.
2. Advanced Packer and Obfuscation Detection: Organizations need EDR solutions capable of advanced behavioral analysis and unpacker technologies to detect and neutralize threats distributed via packer-as-a-service offerings like HardCrypt and Shaa. Reliance on static signatures alone is insufficient against polymorphic and heavily obfuscated malware.
3. Kernel-Level Protection and Tamper Resistance: EDR products must possess strong self-protection capabilities at the kernel level to prevent malicious drivers from gaining unauthorized write access to kernel structures or directly disabling security components. This includes monitoring for unexpected process or service termination attempts, and particularly, unusual driver interactions.
4. Proactive Vulnerability Management: The rapid exploitation of zero-day or recently disclosed vulnerabilities (e.g., SimpleHelp RCE) underscores the importance of a swift and comprehensive patching strategy. Attackers are quick to weaponize new exploits to gain initial access, often preceding EDR killer deployment.
5. Disk Activity and Volume Management Monitoring: The novel EDR evasion technique involving disk partitioning and file movement necessitates advanced monitoring of disk I/O and volume management events. Security teams should look for unusual activity such as the creation of new disk volumes, moving of critical system or security product directories, especially just before a system reboot. This requires deep visibility into low-level operating system functions.
6. Threat Intelligence Integration: Leveraging threat intelligence that maps overlaps in tooling and techniques between ransomware groups can significantly enhance defensive postures. Understanding these connections helps predict adversary evolution, attribute attacks, and anticipate emerging TTPs. Security teams should actively seek out and integrate such intelligence into their detection and response strategies.
7. Supply Chain Security Awareness: The abuse of legitimate binaries for sideloading and packing highlights the need for vigilance regarding software downloaded from seemingly trusted sources. Implement application whitelisting and ensure software integrity checks are in place.
8. Multi-Layered Security Approach: No single security control is foolproof. A defense-in-depth strategy, combining network segmentation, strong authentication, regular backups, user education, and advanced endpoint protection, remains paramount. Behavioral detection at multiple stages of the kill chain is crucial to catch sophisticated evasion attempts.

Key Takeaways

• Ransomware groups are increasingly reliant on sophisticated EDR killers and evasion techniques to bypass modern security products, which are otherwise effective at stopping attacks.
• Packer-as-a-service offerings like HardCrypt and Shaa significantly lower the barrier for attackers to distribute obfuscated EDR killers and initial access malware, making these tools widely accessible.
• Many EDR killer operations leverage malicious kernel drivers, often signed with compromised or expired digital certificates, or exploit legitimate vulnerable drivers to gain privileged access and disable security components.
• A novel, undocumented EDR evasion technique involves using legitimate disk management software to move EDR components to a new disk volume, effectively disabling protection upon reboot without triggering traditional tamper alerts.
• Significant overlaps in tooling and knowledge among ransomware groups (e.g., shared EDR killers, the disk management trick) suggest close collaboration, affiliate migration, or even entire operation transitions between different ransomware families.
• Defenders must adopt multi-layered security strategies, focusing on robust driver integrity checks, advanced behavioral analysis for packed executables, deep monitoring of disk and kernel activity, and proactive threat intelligence to counter these evolving threats.

About the Speaker(s)

Gabor Szappanos is a Principal Researcher at Sophos. He has a long-standing history of research into ransomware attack chains, having previously presented at VB Localhost about the preparatory phases preceding ransomware execution. His work focuses on analyzing the toolsets and procedures used by ransomware actors, with a particular emphasis on EDR evasion techniques and understanding the operational dynamics of threat groups.

Steeve Gaudreault is a Principal Threat Researcher at Sophos and a co-author of the research presented. He has previously collaborated with Gabor on topics such as packer-as-a-service offerings, referred to as "impersonators," indicating his expertise in malware obfuscation and distribution methods. Unfortunately, Steeve was unable to attend the conference to present alongside Gabor.