Recent reports have highlighted RansomHub’s use of the EDR Kill Shifter, a tool specifically designed to disable or bypass Endpoint Detection and Response (EDR) solutions during ransomware attacks.
What is the EDR Kill Shifter?
EDR Kill Shifter targets EDR solutions on a compromised system. It is designed to manipulate or terminate EDR processes, so that attackers can move laterally within the network and execute ransomware payloads without detection or automated responses.
EDR Kill Shifter operates on two levels:
- Process Manipulation: The tool blocks core EDR processes by killing or moving them to a state without detection capabilities.
- Endpoint Persistence: When EDR is disabled, an attacker has persistent access to the endpoint and can deploy ransomware or start data exfiltration.
This enables attackers to maximize dwell time, deploy ransomware, and exfiltrate sensitive data undetected in RansomHub attacks.
Cybercrime and EDR Killers
EDR killers have been developed and sold on cybercrime forums for multiple years, but the pricing for these types of tools can range from thousands to even tens of thousands of dollars. This is primarily due to their specialized nature.
Image: An example of an EDR killer being sold on a cybercrime forum
Consider the advertisement from 2022 mentioned above. It showcases an extensive list of antivirus and EDR solutions that a particular EDR killer tool can disable. However, what’s even more noteworthy is that this tool has been consistently updated and maintained for two years.
Image: An example of SentinelOne and CrowdStrike being killed
You can see that in just February this year, the seller or author updated the tool to include capabilities to kill SentinelOne and CrowdStrike, which are two major EDR providers.
The Limitations of EDR
EDR solutions are intended to identify, isolate, and respond to malicious activities at the endpoint level but are not immune to targeted evasion tactics. Tools like EDR Kill Shifter exploit weaknesses in EDR solutions when deployed in an environment without additional security layers.
Key vulnerabilities in relying solely on EDR include:
- Single Point of Failure: Once an EDR solution is compromised, there are usually no immediate defenses left, leaving the system vulnerable.
- Post-Compromise Detection: EDR systems often detect threats after the initial compromise, meaning attackers may have already moved laterally or escalated privileges.
- Limited Visibility: EDR focuses on endpoint-level activities, lacking visibility into network-level or cloud-based threats that may bypass endpoint defenses.
- Evasion Techniques: For advanced attackers this may include fileless malware, polymorphic malware or EDR killer tools.
- High False Positives: EDR solutions may produce excessive false positives resulting in alert fatigue and possibly ignoring real threats.
- Resource Intensive: EDR solutions need big computational resources, which might impact endpoints performances, especially in resource constrained environments.
- Inconsistent Coverage: EDR is usually restricted to some endpoint types and leaves other devices like mobile or IoT systems vulnerable.
- Delayed Response: EDR can detect malicious activity, but the response is sometimes delayed allowing attackers time to carry out their objectives.
- Absence of Data Exfiltration Prevention: EDR focuses on detection and response but may not prevent data exfiltration during an active attack.
- Limited Automation: EDR solutions often require manual intervention for full remediation, which delays response to an attack if a team is unavailable or overwhelmed.
The Importance of ADX
BlackFog delivers a comprehensive cybersecurity solution designed to prevent these threats from succeeding, even when EDR is bypassed.
Our unique anti data exfiltration (ADX) technology acts as the final safeguard, blocking data from being transferred out of your network—whether attackers are deploying ransomware, spyware, or trying to leak sensitive information.
BlackFog proactively defends against the most advanced attack techniques, automatically blocking threats 24/7 and without the need for human intervention.
Our platform continuously monitors network behavior in real time, detecting suspicious activity like unauthorized attempts to contact command-and-control (C2) servers or export sensitive data.
Learn more about how BlackFog protects businesses from ransomware attacks and other cyberthreats.
Related Posts
Ransomware Containment: Effective Strategies to Protect Your Business
Discover effective ransomware containment strategies for your business. This guide discusses network segmentation, zero trust, and practical best practices for IT managers and cybersecurity professionals to reduce ransomware damage.
Ransomware Meets Retail: Sainsbury’s, Starbucks and Morrisons Feel the Heat from Blue Yonder Attack
The Blue Yonder ransomware attack disrupted major retailers like Sainsbury’s, Starbucks, and Morrisons, highlighting the vulnerabilities of global supply chains and the urgent need for stronger cybersecurity defenses.
Top 5 Cyberattacks During Black Friday and Thanksgiving
Find out about the top five biggest cyberattacks for Black Friday and Thanksgiving, from data breaches and ransomware, to see the risks businesses experience during the holidays.
Healthcare Ransomware Attacks: How to Prevent and Respond Effectively
Learn how to protect yourself from healthcare ransomware attacks. We discuss the main security weaknesses, suggest security steps, and offer possible means of protecting patient information.
Everything That You Need to Know About the Dark Web and Cybercrime
Learn about the dark web, including who uses it, how it operates, and what tools cybercriminals obtain on it. Find out how BlackFog monitors networks, forums, and ransomware leak sites in order to stay ahead of new threats.
Ongoing: New Ransomware Gangs in 2024
Ransomware gangs continue to break records and BlackFog will track all new ransomware gangs in 2024.