Cybercriminals have been spotted using a new piece of malware designed to completely wipe out any antivirus programs the victim might have installed on their endpoint and infect them with ransomware.
Researchers from Sophos have reported encountering a new utility tool designed to kill EDRs (Endpoint Detection and Response), which they called EDRKillShifter.
The tool was used by a ransomware group known as RansomHub, but Sophos argues, “with moderate confidence”, it is being used by multiple attackers. This could mean that it was developed by a third party, and possibly offered for sale (or for rent) on the dark web.
EDRKillShifter
In the instance Sophos analyzed, the group tried to use EDRKillShifter to terminate Sophos protection on the targeted computer, but the tool failed. As a result, the encryptor also failed and the entire attempt was abandoned.
In its analysis of EDRKillShifter, Sophos describes it as a loader that drops a legitimate, but vulnerable driver. This, too, isn’t exactly new practice, since “Bring Your Own Vulnerable Driver” attacks have been around for years. In these attacks, the crooks would drop an older version of a driver onto the target machine, which the operating system accepts.
Then, they abuse the holes found in that driver to deploy malware.
Depending on the threat actor’s requirements, EDRKillShifter delivers a variety of different driver payloads, it was said.
To defend against this threat, Sophos suggests users check whether their endpoint security products implement, and enable, tamper protection. Furthermore, businesses should practice “strong hygiene” for Windows security roles, since the attack is only possible if the attacker escalates privileges they control, or if they can obtain admin rights. Finally, businesses should keep their systems updated, as Microsoft recently started de-certifying old signed drivers.
