RansomHub Group Deploys New EDR-Killing Tool in Latest Cyber Attacks
15-August-24
A cybercrime group with links to the RansomHub ransomware has been observed using a new tool designed to terminate endpoint detection and response (EDR) software on compromised hosts, joining the likes of other similar programs like AuKill (aka AvNeutralizer) and Terminator.
The EDR-killing utility has been dubbed EDRKillShifter by cybersecurity company Sophos, which discovered the tool in connection with a failed ransomware attack in May 2024.
“The EDRKillShifter tool is a ’loader’ executable – a delivery mechanism for a legitimate driver that is vulnerable to abuse (also known as a ‘bring your own vulnerable driver,’ or BYOVD, tool),” security researcher Andreas Klopsch said. “Depending on the threat actor’s requirements, it can deliver a variety of different driver payloads.“RansomHub, a suspected rebrand of the Knight ransomware, surfaced in February 2024, leveraging known security flaws to obtain initial access and drop legitimate remote desktop software such as Atera and Splashtop for persistent access.
Last month, Microsoft revealed that the notorious e-crime syndicate known as Scattered Spider has incorporated ransomware strains such as RansomHub and Qilin into its arsenal.Executed via command-line along with a password string input, the executable decrypts an embedded resource named BIN and executes it in memory. The BIN resource unpacks and runs a Go-based final, obfuscated payload, which then takes advantage of different vulnerable, legitimate drivers to gain elevated privileges and disarm EDR software.
“The binary’s language property is Russian, indicating that the malware author compiled the executable on a computer with Russian localization settings,” Klopsch said. “All of the unpacked EDR killers embed a vulnerable driver in the .data section.“To mitigate the threat, it’s recommended to keep systems up-to-date, enable tamper protection in EDR software, and practice strong hygiene for Windows security roles.
“This attack is only possible if the attacker escalates privileges they control, or if they can obtain administrator rights,” Klopsch said. “Separation between user and admin privileges can help prevent attackers from easily loading drivers.”
The development comes as threat actors have been observed delivering a new stealthy malware called SbaProxy by modifying legitimate antivirus binaries from BitDefender, Malwarebytes, and Sophos, and signing the files again with counterfeit certificates in order to establish proxy connections through a command-and-control (C2) server as part of an ongoing campaign.
SbaProxy is engineered to set up a proxy connection between the client and the target such that it routes the traffic through the C2 server and the infected machine. The malware only supports TCP connections.
“This threat has a significant impact, as it can be used to create proxy services that facilitate malicious activities and potentially be sold for financial gain,” AT&T LevelBlue Labs said. “This tool, distributed in various formats such as DLLs, EXEs, and PowerShell scripts, is challenging to detect due to its sophisticated design and legitimate appearance.”
